Octagon Android Banking Bot + Mirage2FA Session Hijacking + APT36 Operation RapidRust: OTX Pulse Analysis — Enterprise Credential Theft Detection Pack

---
title: Octagon Android Bot - Accessibility Overlay and VNC Fraud Behavior
description: Detects Android accessibility service abuse, overlay injection, and hidden VNC indicators associated with the Octagon banking trojan MaaS distributed by AndroidKitKat
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: android
  service: accessibility
detection:
  selection_accessibility:
    event_type:
      - 'accessibility_service_enabled'
      - 'TYPE_WINDOW_STATE_CHANGED'
    package_name|contains:
      - 'crypto'
      - 'wallet'
      - 'bank'
      - 'exchange'
  selection_overlay:
    action:
      - 'SYSTEM_ALERT_WINDOW'
      - 'TYPE_APPLICATION_OVERLAY'
      - 'FLAG_FULLSCREEN'
  selection_vnc:
    network_port:
      - 5900
      - 5901
      - 5902
  condition: selection_accessibility and (selection_overlay or selection_vnc)
fields:
  - package_name
  - accessibility_service
  - overlay_target
tags:
  - attack.t1517
  - attack.t1636
  - attack.mobile.t1517
falsepositives:
  - Legitimate screen readers and password managers using accessibility APIs
level: high
---
title: Mirage2FA AiTM Phishing - HTML Smuggling and WebSocket Session Relay
description: Detects HTML smuggling delivery and WebSocket-based session relay patterns consistent with Mirage2FA adversary-in-the-middle phishing kit targeting Microsoft 365 credentials and session tokens
id: a1b2c3d4-aitm-mirage2fa-0001
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: network_connection
detection:
  selection_browser:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
  selection_websocket:
    DestinationHostname|contains:
      - '.store'
      - '.shop'
      - '.site'
      - '.info'
    Initiated: 'true'
  selection_phish_domains:
    DestinationHostname|contains:
      - 'sopbtech.store'
      - 'pcvgtech.store'
      - 'verpox.shop'
      - 'pslcertlive.site'
      - 'rsxbenefits.com'
      - 'vslbertlive.info'
      - 'galatasaraydanhaberler.com'
      - 'cementslabconstruction.com'
  condition: selection_browser and (selection_phish_domains or selection_websocket)
fields:
  - DestinationHostname
  - DestinationIp
  - ProcessId
falsepositives:
  - Legitimate sites on low-cost TLDs (rare in enterprise context)
level: high
---
title: APT36 RUSTYSHADE - GitHub Repository C2 and Encrypted Tasking
description: Detects non-developer processes making outbound connections to GitHub API endpoints consistent with RUSTYSHADE backdoor using private GitHub repositories as AES-256-GCM encrypted C2 channels in Operation RapidRust
id: b2c3d4e5-rapidrust-gh-c2-0002
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  product: windows
  category: network_connection
detection:
  selection_github:
    DestinationHostname|contains:
      - 'api.github.com'
      - 'raw.githubusercontent.com'
      - 'github.com'
  selection_suspicious_process:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\cmd.exe'
  filter_dev_tools:
    Image|endswith:
      - '\git.exe'
      - '\gh.exe'
      - '\code.exe'
      - '\devenv.exe'
      - '\idea64.exe'
  condition: selection_github and selection_suspicious_process and not filter_dev_tools
fields:
  - Image
  - CommandLine
  - DestinationHostname
falsepositives:
  - PowerShell module installers (Install-Module), admin scripts pulling from GitHub - tune by repository path
level: high

// Mirage2FA AiTM + RapidRust GitHub C2 + Octagon IOC retro-hunt
// Microsoft Sentinel unified hunt — run over last 30 days

let Mirage2FADomains = dynamic([
  "galatasaraydanhaberler.com", "sopbtech.store", "pcvgtech.store",
  "verpox.shop", "cementslabconstruction.com", "pslcertlive.site",
  "rsxbenefits.com", "vslbertlive.info"
]);
let OctagonHashes = dynamic([
  "3530b1600e059468e585d48482bb2f375edfe5cb5c23862b01d8405ab56376b9",
  "41d922a220ac28a4af8cbed3ffff517bfc5087f11c52801a1be0353e22a71fe0",
  "54bccb0626f91a85d70803f4ecadd5cbd303f5e9"
]);

// PART 1: Mirage2FA phishing infrastructure hits
let PhishHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any (Mirage2FADomains)
| project PhishHitTime=TimeGenerated, DeviceName, InitiatingProcessAccountName,
          RemoteUrl, RemoteIP, InitiatingProcessFileName;

// PART 2: GitHub-as-C2 behavioral detection (RUSTYSHADE pattern)
let GitHubC2 = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any ("api.github.com", "raw.githubusercontent.com")
| where InitiatingProcessFileName in~ ("powershell.exe", "pwsh.exe", "cmd.exe",
        "wscript.exe", "cscript.exe", "mshta.exe", "rundll32.exe")
| project GHTime=TimeGenerated, DeviceName, InitiatingProcessCommandLine,
          RemoteUrl, InitiatingProcessAccountName;

// PART 3: Octagon hash matches on any synced mobile/endpoint file events
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 has_any (OctagonHashes) or MD5 in (
    "3530b1600e059468e585d48482bb2f37", "41d922a220ac28a4af8cbed3ffff517b",
    "471bcf065c6ed44282c5776ee78bc6d0", "b7e9072e5bda17e0c68db01010658481",
    "d472e984c6e8f3d4d7352125ebcc7c3c")
| project HashTime=TimeGenerated, DeviceName, FileName, FolderPath, SHA256;

// PART 4: Identity correlation — risky sign-ins for users who hit phishing infra
let CompromisedUsers = PhishHits
| distinct InitiatingProcessAccountName;
let IdentityRisk = SigninLogs
| where TimeGenerated > ago(30d)
| where UserPrincipalName has_any (CompromisedUsers)
| where ResultType != 0 or (RiskLevelDuringSignIn in ("high", "medium"))
| project SigninTime=TimeGenerated, UserPrincipalName, IPAddress,
          ResultType, RiskLevelDuringSignIn, AppDisplayName, Location;

union PhishHits, HashHits
| sort by PhishHitTime desc;
GitHubC2;
IdentityRisk

# Security Arsenal — Operation RapidRust / Mirage2FA endpoint hunt script
# Checks for persistence artifacts, suspicious GitHub C2 connections,
# and phishing-domain DNS cache residue. Run elevated on Windows endpoints.

$Report = @()
$Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"

Write-Host "[*] RapidRust/Mirage2FA IOC Hunt — $Timestamp" -ForegroundColor Cyan

# 1. Hunt for suspicious processes with active GitHub API connections (RUSTYSHADE pattern)
Write-Host "`n[1] Checking for non-dev processes with GitHub connections..." -ForegroundColor Yellow
$SuspectProcs = @("powershell","pwsh","cmd","wscript","cscript","mshta","rundll32","regsvr32")
$GitHubConns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemotePort -eq 443 } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        if ($proc -and $SuspectProcs -contains $proc.ProcessName) {
            $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
            if ($dns -match "github|githubusercontent") {
                [PSCustomObject]@{
                    Type = "GitHubC2-Suspect"; Process = $proc.ProcessName
                    PID = $proc.Id; RemoteIP = $_.RemoteAddress; Resolved = $dns
                }
            }
        }
    }
if ($GitHubConns) { $Report += $GitHubConns; $GitHubConns | Format-Table -AutoSize }
else { Write-Host "    No suspicious GitHub connections found." -ForegroundColor Green }

# 2. DNS cache check for Mirage2FA phishing domains
Write-Host "`n[2] Checking DNS cache for Mirage2FA phishing infrastructure..." -ForegroundColor Yellow
$PhishDomains = @("sopbtech.store","pcvgtech.store","verpox.shop","pslcertlive.site",
    "rsxbenefits.com","vslbertlive.info","galatasaraydanhaberler.com","cementslabconstruction.com")
$DNSHits = Get-DnsClientCache -ErrorAction SilentlyContinue |
    Where-Object { $d = $_.Entry; $PhishDomains | Where-Object { $d -like "*$_*" } }
if ($DNSHits) {
    $DNSHits | ForEach-Object { $Report += [PSCustomObject]@{
        Type="PhishDNS-Cache"; Process="n/a"; PID="n/a"; RemoteIP=$_.Data; Resolved=$_.Entry } }
    $DNSHits | Format-Table Entry, Data -AutoSize
} else { Write-Host "    No phishing domain cache residue." -ForegroundColor Green }

# 3. Persistence sweep — scheduled tasks with PowerShell/script payloads (PSNATCH pattern)
Write-Host "`n[3] Sweeping scheduled tasks for script-based persistence..." -ForegroundColor Yellow
$SusTasks = Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match "powershell|pwsh|wscript|cscript|mshta|cmd" -and
    $_.Actions.Arguments -match "-enc|-w hidden|bypass|iex|downloadstring|github" -and
    $_.TaskPath -notmatch "\\Microsoft\\"
}
if ($SusTasks) {
    $SusTasks | ForEach-Object { $Report += [PSCustomObject]@{
        Type="Persistence-Task"; Process=$_.TaskName; PID="n/a"
        RemoteIP="n/a"; Resolved=$_.Actions.Arguments } }
    $SusTasks | Format-Table TaskName, TaskPath -AutoSize
} else { Write-Host "    No suspicious scheduled tasks." -ForegroundColor Green }

# 4. Run-key persistence check
Write-Host "`n[4] Checking Run keys for suspicious entries..." -ForegroundColor Yellow
$RunKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $RunKeys) {
    Get-ItemProperty $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match "powershell|appdata|temp|github|\.ps1" -and
            $_.Name -notmatch "^PS"
        } | ForEach-Object {
            $Report += [PSCustomObject]@{
                Type="Persistence-RunKey"; Process=$_.Name; PID="n/a"
                RemoteIP="n/a"; Resolved=$_.Value }
            Write-Host "    [HIT] $key -> $($_.Name) = $($_.Value)" -ForegroundColor Red
        }
    }
}

# 5. Export findings
if ($Report.Count -gt 0) {
    $OutFile = "$env:TEMP\RapidRust_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $Report | Export-Csv $OutFile -NoTypeInformation
    Write-Host "`n[!] $($Report.Count) findings exported to $OutFile" -ForegroundColor Red
} else {
    Write-Host "`n[+] Hunt complete — no indicators found." -ForegroundColor Green
}