MovieReaper Torrent Loader, HEAVYGRAM Telegram Backdoor & Fake HTS Ransomware: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Quasar RAT / Fake HTS Persistence via Registry Run Key
id: 9f2a1b7e-hts1-4a3d-8c5e-202609180001
status: experimental
description: Detects registry autorun persistence consistent with Quasar RAT deployed via fraudulent UBP Asset Home Trading System installers
author: Security Arsenal Threat Intel
logsource:
    category: registry_set
    product: windows
    # RegistryEvent or Sysmon EventID 13
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run\'
            - '\CurrentVersion\RunOnce\'
    selection_value:
        Details|contains:
            - 'UBP'
            - 'HTS'
            - 'Trading'
            - 'quasar'
    filter_legit:
        Image|endswith:
            - '\msiexec.exe'
    condition: selection_key and selection_value and not filter_legit
falsepositives:
    - Legitimate trading platform updaters in Korean financial environments
level: high
tags:
    - attack.persistence
    - attack.t1547.001
date: 2026/09/18
---
title: MovieReaper UAC Bypass and Blockchain C2 Staging
id: 8e1b2c6f-mvr2-4b2e-9d4f-202609180002
status: experimental
description: Detects UAC bypass abuse patterns and network access to MovieReaper infrastructure or Solana RPC endpoints from non-wallet processes
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_uacbypass:
        Image|endswith:
            - '\fodhelper.exe'
            - '\computerdefaults.exe'
            - '\sdclt.exe'
        ParentImage|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
    selection_network:
        CommandLine|contains:
            - 'api.mainnet-beta.solana.com'
            - 'solana-rpc'
            - 'deadhub.org'
            - '208.64.33.90'
    condition: 1 of selection_*
falsepositives:
    - Legitimate Solana wallet or DeFi tooling (rare on corporate endpoints)
level: critical
tags:
    - attack.privilege_escalation
    - attack.t1548.002
    - attack.command_and_control
    - attack.t1071.001
date: 2026/09/18
---
title: HEAVYGRAM Telegram Bot API C2 from Non-Telegram Process
id: 7d0c3a5b-hvg3-4c1f-ae6b-202609180003
status: experimental
description: Detects HTTPS connections to the Telegram Bot API from processes other than the legitimate Telegram Desktop client, consistent with HEAVYGRAM surveillance backdoor C2
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
    # Sysmon EventID 3
detection:
    selection_dst:
        DestinationHostname|contains:
            - 'api.telegram.org'
    filter_telegram:
        Image|endswith:
            - '\Telegram.exe'
            - '\Telegram Desktop.exe'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    condition: selection_dst and not filter_telegram and not filter_browsers
falsepositives:
    - Custom IT automation scripts using Telegram bots for alerting (allowlist by binary path and signer)
level: high
tags:
    - attack.command_and_control
    - attack.t1102.002
    - attack.exfiltration
    - attack.t1041
date: 2026/09/18

// Security Arsenal — OTX 2026-09-18 Multi-Campaign Hunt
// HEAVYGRAM Telegram C2, MovieReaper infra, Fake HTS ransomware indicators
let IoCDomains = dynamic(["api.telegram.org", "deadhub.org", "phf-ubp.com"]);
let IoCIPs = dynamic(["208.64.33.90"]);
let IoCHashes = dynamic([
    "ed7f260d4163d31add855a19652fa7c0adcc2eba4e0281f872eb7f43e0769814",
    "5b26921e4f7b4dac140297b0401cf0f56e1d4852",
    "6d2cd65dbd0df30404b08ff007359e54",
    "4843f9fafcae492f11e2d4d33dbb4cdd",
    "5310cabae3fbe6db8742849b588093f9",
    "a0b13781edd7cfdab13d79afff3c83c1"
]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl in (IoCDomains) or RemoteIP in (IoCIPs)
    // HEAVYGRAM: flag Telegram API calls NOT from the Telegram client
    | extend TelegramAbuse = iff(RemoteUrl == "api.telegram.org"
        and InitiatingProcessFileName !in~ ("Telegram.exe", "chrome.exe", "msedge.exe", "firefox.exe"), "HIGH - Telegram C2", "IoC Match")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
              RemoteIP, RemoteUrl, TelegramAbuse;
let HashHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 in (IoCHashes) or SHA1 in (IoCHashes) or MD5 in (IoCHashes)
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, MD5;
let SolanaC2 =
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has "solana" or InitiatingProcessCommandLine has_any ("solana", "mainnet-beta")
    | where InitiatingProcessFileName !in~ ("phantom.exe", "solana.exe")  // allowlist known wallets
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, InitiatingProcessCommandLine;
NetworkHits
| union HashHits, SolanaC2
| sort by TimeGenerated desc

# Security Arsenal - OTX 2026-09-18 IOC Hunt Script
# Targets: Quasar RAT persistence, MovieReaper artifacts, HEAVYGRAM Telegram C2
# Run elevated on endpoints or deploy via RMM/Intune remediations

$Report = @()

# --- 1. Quasar RAT / Fake HTS persistence: Run keys ---
$RunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $Key).($_.Name)
            if ($val -match 'UBP|HTS|Trading|quasar|AppData.*\.exe') {
                $Report += [PSCustomObject]@{Type='Persistence'; Artifact="$Key -> $($_.Name) = $val"}
            }
        }
    }
}

# --- 2. Hash hunt across common staging paths ---
$BadHashes = @(
    'ed7f260d4163d31add855a19652fa7c0adcc2eba4e0281f872eb7f43e0769814',
    '6d2cd65dbd0df30404b08ff007359e54',
    'a9cce44c4d42b07f114dd2b340f0046a',
    'f86b2ece324cfd36e832a3b48cc3719b'
)
$Paths = @("$env:USERPROFILE\Downloads", "$env:APPDATA", "$env:LOCALAPPDATA\Temp", "C:\ProgramData")
foreach ($Path in $Paths) {
    Get-ChildItem $Path -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($BadHashes -contains $h.ToLower()) {
            $Report += [PSCustomObject]@{Type='MaliciousFile'; Artifact="$($_.FullName) [$h]"}
        }
    }
}

# --- 3. Active/historical network connections to C2 ---
$NetHits = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -eq '208.64.33.90' -or $_.State -eq 'Established'
} | Where-Object { $_.RemoteAddress -eq '208.64.33.90' }
foreach ($Conn in $NetHits) {
    $proc = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
    $Report += [PSCustomObject]@{Type='C2Connection'; Artifact="$($proc.ProcessName) ($($proc.Path)) -> 208.64.33.90"}
}

# --- 4. HEAVYGRAM: non-Telegram processes with recent Telegram API cache/DNS ---
$DnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Name -match 'api\.telegram\.org|deadhub\.org|phf-ubp\.com'
}
foreach ($Dns in $DnsHits) {
    $Report += [PSCustomObject]@{Type='SuspiciousDNS'; Artifact="$($Dns.Name) -> $($Dns.Data)"}
}

# --- 5. MovieReaper: suspicious scheduled tasks (UAC-bypass persistence) ---
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'Temp|AppData|ProgramData' -and $_.TaskPath -notmatch 'Microsoft'
} | ForEach-Object {
    $Report += [PSCustomObject]@{Type='SuspiciousTask'; Artifact="$($_.TaskName) -> $($_.Actions.Execute)"}
}

if ($Report.Count -gt 0) {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv "$env:TEMP\OTX_Hunt_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
    Write-Host "[!] $($Report.Count) suspicious artifacts found - escalate to IR" -ForegroundColor Red
} else {
    Write-Host "[+] No OTX indicators found on $(hostname)" -ForegroundColor Green
}