---
title: Fake Hardware Wallet Electron App Seed Phrase Theft - Operation ASTERIX
id: 8f2a1c44-9a3b-4c2e-a71d-asterix0001
description: Detects execution of counterfeit Ledger/Trezor/Exodus Electron wallet applications associated with Operation ASTERIX crypto fraud, including outbound Telegram API exfiltration.
status: experimental
date: 2026/08/20
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: windows
detection:
  selection_telegram:
    DestinationHostname|contains:
      - 'api.telegram.org'
  selection_wallet_procs:
    Image|contains:
      - '\Ledger'
      - '\Trezor'
      - '\Exodus'
  filter_known_paths:
    Image|startswith:
      - 'C:\Program Files\Ledger Live'
      - 'C:\Program Files\Exodus'
  condition: selection_telegram and selection_wallet_procs and not filter_known_paths
falsepositives:
  - Legitimate wallet applications contacting Telegram support bots (rare)
level: high
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.t1657
---
title: Bait-and-Switch Download Studio / FakeMBAM Installer Execution
id: 7c1d2e55-4b6a-4d3f-b82e-fakembam0002
description: Detects execution of Download Studio installers and FakeMBAM payloads delivered via deceptive download portals impersonating legitimate software.
status: experimental
date: 2026/08/20
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_names:
    Image|endswith:
      - '\DownloadStudio_setup.exe'
      - '\mbam-setup.exe'
      - '\downloadstudio.exe'
  selection_hashes:
    Hashes|contains:
      - 'SHA256=9A3F6E69C12CB814C45862219ECB17E9AB7744877C9DA1C49F3EA046437F8FCA'
  selection_parent_browser:
    ParentImage|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: (selection_names or selection_hashes) and selection_parent_browser
falsepositives:
  - None expected for hash match; name matches may hit legitimate software named similarly
level: high
tags:
  - attack.initial_access
  - attack.t1189
  - attack.t1204.002
---
title: VBS Dropper Installing ScreenConnect RMM via Phishing Lure
id: 6e0f3a22-1c5d-4e9a-c73d-screencon003
description: Detects wscript/cscript execution of VBS scripts followed by ScreenConnect client installation or service creation, consistent with transaction-receipt phishing campaigns abusing RMM tooling.
status: experimental
date: 2026/08/20
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_vbs:
    ParentImage|endswith:
      - '\wscript.exe'
      - '\cscript.exe'
    Image|endswith:
      - '\msiexec.exe'
      - '\powershell.exe'
      - '\cmd.exe'
  selection_screenconnect:
    CommandLine|contains:
      - 'ScreenConnect'
      - 'relay.gamedbd.com'
      - 'screenconnect.clientservice'
  condition: selection_vbs or selection_screenconnect
falsepositives:
  - Legitimate IT-managed ScreenConnect deployments - whitelist approved relay domains
level: critical
tags:
  - attack.execution
  - attack.t1059.005
  - attack.command_and_control
  - attack.t1219
  - attack.persistence
  - attack.t1543.003

// Hunt: Operation ASTERIX fake-wallet infra, Download Studio/FakeMBAM network,
// and ScreenConnect relay abuse — last 30 days
let AsterixIndicators = dynamic(["ledgerhelp.com", "136.0.213.184"]);
let DownloadStudioIndicators = dynamic(["apis.downloadstud.io", "r.byteengineering.net", "getdownloadstudio.net", "getavast.ru", "4kvideodownloader.ru", "acronisportal.ru", "cristalixmine.ru"]);
let ScreenConnectIndicators = dynamic(["relay.gamedbd.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in (AsterixIndicators)
   or RemoteUrl in (DownloadStudioIndicators)
   or RemoteUrl in (ScreenConnectIndicators)
   or RemoteIP == "136.0.213.184"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let VbsDroppers = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("wscript.exe", "cscript.exe")
| where ProcessCommandLine has_any (".vbs", "Flash", "update", "receipt")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, SHA256;
let ScreenConnectInstalls = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where ProcessCommandLine has_any ("ScreenConnect", "screenconnect.clientservice")
   or FileName has "ScreenConnect"
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, SHA256;
union NetworkHits, VbsDroppers, ScreenConnectInstalls
| sort by TimeGenerated desc

# Security Arsenal — Multi-Campaign IOC Hunt (ASTERIX / FakeMBAM / ScreenConnect)
# Run elevated on endpoints or via your RMM/SCCM fleet-wide
$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. Known malicious file hashes (SHA256 from OTX pulses) ---
$badHashes = @(
    '0F2C7194F1F577E73460DB9EC2E75FC0C7F845588CBD4246333B7A4FBEC90D9F',
    '4BEE9AFFFF9FA718A2C94F02EBE6A75143D4D461D291C2DF9B769920FC927BF8',
    '7073B2A3A34525C5969921DD17EF1FA5607AF92BE78B3FC6129CDEA73216691A',
    '918FA540126B7DB6424652D84A5CE7E968947136DB3D6E3E0CAB30EA309E25A2',
    '961A398A5C71E837626B5FCE68E44B14A5D220E3BD74A3D0ECD61A2762C38176',
    'BA9D459169A303067A4FE36C8B8582A5EA023B9C270DAFE89613BAB840501B19',
    '9A3F6E69C12CB814C45862219ECB17E9AB7744877C9DA1C49F3EA046437F8FCA',
    'B64572B3DF55930638DB3226D9213D5E55C7165D28AE75782CF72967C2AEFFA0',
    '82A7410B7C56F5389831C89334517ACD2DC409BADE29F286507721455ABEB5D3'
)
$searchPaths = @("$env:USERPROFILE\Downloads", "$env:TEMP", 'C:\Users\Public\Downloads')
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        if ($badHashes -contains $h) {
            $report += [pscustomobject]@{Type='MaliciousFile'; Path=$_.FullName; Hash=$h}
        }
    }
}

# --- 2. ScreenConnect persistence: services and run keys ---
$services = Get-CimInstance Win32_Service | Where-Object { $_.Name -match 'ScreenConnect' -or $_.PathName -match 'ScreenConnect|gamedbd' }
foreach ($s in $services) {
    $report += [pscustomobject]@{Type='SuspiciousService'; Path=$s.PathName; Hash=$s.Name}
}
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    Get-ItemProperty -Path $k | Out-Null
    $props = (Get-Item $k).Property
    foreach ($prop in $props) {
        $val = (Get-ItemProperty -Path $k -Name $prop).$prop
        if ($val -match 'ScreenConnect|DownloadStudio|gamedbd|downloadstud') {
            $report += [pscustomobject]@{Type='PersistenceRunKey'; Path="$k\$prop"; Hash=$val}
        }
    }
}

# --- 3. Scheduled tasks from Download Studio / droppers ---
Get-ScheduledTask | Where-Object { $_.TaskName -match 'DownloadStudio|Flash.*Update|WalletUpdate' } | ForEach-Object {
    $report += [pscustomobject]@{Type='SuspiciousScheduledTask'; Path=$_.TaskPath; Hash=$_.TaskName}
}

# --- 4. Active network connections to C2 / relay infra ---
$badHosts = @('136.0.213.184')
$badDns   = @('ledgerhelp.com','apis.downloadstud.io','r.byteengineering.net','getdownloadstudio.net','relay.gamedbd.com')
Get-NetTCPConnection -State Established | ForEach-Object {
    if ($badHosts -contains $_.RemoteAddress -or $_.RemotePort -eq 1337) {
        $proc = (Get-Process -Id $_.OwningProcess).ProcessName
        $report += [pscustomobject]@{Type='C2Connection'; Path="$($_.RemoteAddress):$($_.RemotePort)"; Hash=$proc}
    }
}
# DNS cache check for domain indicators
Get-DnsClientCache | Where-Object { $n = $_.Entry; $badDns | Where-Object { $n -like "*$_*" } } | ForEach-Object {
    $report += [pscustomobject]@{Type='DNSCacheHit'; Path=$_.Entry; Hash=$_.Data}
}

# --- 5. Fake wallet app directories (ASTERIX) ---
$walletDirs = @("$env:LOCALAPPDATA\Programs\ledger", "$env:LOCALAPPDATA\Programs\trezor", "$env:LOCALAPPDATA\Programs\exodus")
foreach ($d in $walletDirs) {
    if (Test-Path $d) {
        $report += [pscustomobject]@{Type='FakeWalletAppDir'; Path=$d; Hash='Review binaries vs official publisher signature'}
    }
}

if ($report.Count -gt 0) {
    Write-Host "[!] SUSPICIOUS ARTIFACTS FOUND:" -ForegroundColor Red
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path "$env:TEMP\OTX_Hunt_$(Get-Date -Format yyyyMMdd_HHmmss).csv" -NoTypeInformation
} else {
    Write-Host '[+] No indicators found on this host.' -ForegroundColor Green
}