PATCHCORD, SHEETCORD & Evooo1Bot: Google Sheets C2 Espionage + Linux Botnet Credential Theft — OTX Detection Pack

---
title: SHEETCORD / Cloud SaaS C2 — Non-Browser Process Accessing Google Sheets API
id: 8f3a1c2e-7b4d-4e9f-a1c5-6d2b8e0f9a31
status: experimental
description: Detects non-browser processes communicating with Google Sheets/Docs API endpoints, consistent with SHEETCORD (Operation C-Major) using Google Sheets as a C2 dead-drop channel.
author: Security Arsenal Threat Intelligence
references:
    - https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/
date: 2026/08/14
modified: 2026/08/14
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1102.002
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'sheets.googleapis.com'
            - 'docs.google.com'
            - 'googleapis.com'
    selection_browser_paths:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\Teams.exe'
            - '\OUTLOOK.EXE'
    condition: selection_domain and not selection_browser_paths
falsepositives:
    - Google Drive for Desktop, legitimate backup/sync agents, RMM tooling
level: high
---
title: HackBrowserData Browser Credential Dump Execution
id: 2c7e91a4-3d5f-4b8a-9e1c-0a6f4d8b2c17
status: experimental
description: Detects execution of HackBrowserData or similar browser credential theft tooling, deployed by the PATCHCORD/Operation C-Major cluster to harvest saved credentials from Chrome, Edge, and Firefox.
author: Security Arsenal Threat Intelligence
references:
    - https://www.acronis.com/en/tru/posts/patchcord-new-malware-cluster-targets-afghan-telecom-and-south-asian-critical-infrastructure/
date: 2026/08/14
modified: 2026/08/14
tags:
    - attack.credential_access
    - attack.t1555
    - attack.t1555.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_binary:
        Image|endswith:
            - '\hackbrowserdata.exe'
        OriginalFileName|contains:
            - 'hack-browser-data'
    selection_behavior:
        CommandLine|contains|all:
            - 'browser'
            - '-b'
        CommandLine|contains:
            - 'all'
            - 'chrome'
            - 'firefox'
    selection_copy:
        CommandLine|contains:
            - 'Login Data'
            - 'Local State'
            - 'Web Data'
            - 'logins.json'
            - 'key4.db'
    condition: selection_binary or selection_behavior or selection_copy
falsepositives:
    - Legitimate forensic tools, IT migration scripts (rare)
level: high
---
title: Miasma v3 — Suspicious npm Postinstall Executing Obfuscated Payload or External Fetch
id: 5b1d8f36-9a2c-4e7d-b3f1-8c0e2a6d4b59
status: experimental
description: Detects node/npm lifecycle scripts spawning network fetches, shells, or script interpreters — consistent with the Miasma v3 worm delivered via hijacked AsyncAPI npm packages in CI/CD and developer environments.
author: Security Arsenal Threat Intelligence
references:
    - https://research.jfrog.com/post/miasma-worm-returns-to-npm/
date: 2026/08/14
modified: 2026/08/14
tags:
    - attack.execution
    - attack.t1059
    - attack.t1195
    - attack.t1195.002
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\npm.exe'
            - '\npx.cmd'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\curl.exe'
            - '\wget.exe'
            - '\certutil.exe'
            - '\rundll32.exe'
    selection_suspicious:
        CommandLine|contains:
            - '85.137.53.71'
            - 'obfuscator'
            - 'FromBase64String'
            - '-enc '
            - 'IEX'
            - 'Invoke-Expression'
    condition: selection_parent and (selection_child or selection_suspicious)
falsepositives:
    - Legitimate build tooling with postinstall scripts (esbuild, node-gyp); tune per build-agent baseline
level: high

// Security Arsenal — OTX Pulse Hunt: PATCHCORD / Evooo1Bot / Miasma v3 / Phishing Infrastructure
// Scope: network connections to known C2 & phishing IOCs, plus behavioral pivots
let C2IPs = dynamic(["46.30.188.13", "108.187.42.63", "85.137.53.71"]);
let BadDomains = dynamic([
    "appstoore.solutions",
    "tomorrowland-booking.com", "belgium-tomorrowlland.com",
    "belgium-tomorrowlland.info", "belgiumtomoorrowland.com",
    "festreisen.com", "jedemenatomorrowland.cz",
    "mcsdirect.tech", "tmrlnd.shop", "obfuscator.io"
]);
let HashIOC = "0f4073d3c866bc3daf55b25f71250b96ec120db94a4f9cc8fe85b7c9f9d346b3";
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteIP in~ (C2IPs) or RemoteUrl has_any (BadDomains)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend MatchType = "Network IOC"
    ),
    (
    DeviceFileEvents
    | where TimeGenerated > ago(30d)
    | where SHA256 == HashIOC or MD5 == "dce02a45e7bec01df012b626182a2a7f"
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256
    | extend MatchType = "File Hash IOC"
    ),
    (
    // SHEETCORD behavioral pivot: non-browser process hitting Google Sheets API
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any ("sheets.googleapis.com", "docs.google.com")
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe",
                                            "brave.exe", "opera.exe", "Teams.exe", "OUTLOOK.EXE")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteUrl
    | extend MatchType = "Behavioral: SaaS C2"
    ),
    (
    // Miasma v3 behavioral pivot: npm/node spawning download cradles
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "npm", "node")
    | where FileName in~ ("powershell.exe", "pwsh.exe", "curl.exe", "wget.exe",
                          "certutil.exe", "cmd.exe", "bash", "sh")
    | project TimeGenerated, DeviceName, InitiatingProcessCommandLine,
              FileName, ProcessCommandLine
    | extend MatchType = "Behavioral: npm Supply Chain"
    )
| sort by TimeGenerated desc

<#
.SYNOPSIS
    Security Arsenal OTX IOC Hunt — PATCHCORD Cluster / Evooo1Bot / Miasma v3
.DESCRIPTION
    Sweeps a Windows host for indicators and execution artifacts from the
    2026-08-14 OTX pulse set: C2 connections, phishing DNS cache entries,
    malicious file hashes, browser-credential-dump artifacts, and npm infection traces.
#>

$ErrorActionPreference = 'SilentlyContinue'
$findings = @()

# --- 1. Live & historical network connections to C2 IPs ---
$C2IPs = @('46.30.188.13','108.187.42.63','85.137.53.71')
Get-NetTCPConnection | Where-Object { $C2IPs -contains $_.RemoteAddress } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess
    $findings += [PSCustomObject]@{
        Type='Network'; Severity='CRITICAL'
        Detail="Active connection to C2 $($_.RemoteAddress):$($_.RemotePort) by $($proc.ProcessName) (PID $($_.OwningProcess))"
    }
}

# --- 2. DNS cache for C2 / phishing domains ---
$BadDomains = @('appstoore.solutions','tomorrowland-booking.com','belgium-tomorrowlland.com',
                'belgium-tomorrowlland.info','belgiumtomoorrowland.com','festreisen.com',
                'jedemenatomorrowland.cz','mcsdirect.tech','tmrlnd.shop','obfuscator.io')
Get-DnsClientCache | Where-Object { $d=$_.Entry; $BadDomains | Where-Object { $d -like "*$_*" } } | ForEach-Object {
    $findings += [PSCustomObject]@{ Type='DNS Cache'; Severity='HIGH'; Detail="Resolved $($_.Entry) -> $($_.Data)" }
}

# --- 3. File hash hunt in common staging locations ---
$BadHashes = @('0F4073D3C866BC3DAF55B25F71250B96EC120DB94A4F9CC8FE85B7C9F9D346B3')
$paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads","C:\ProgramData")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        if ($BadHashes -contains (Get-FileHash $_.FullName -Algorithm SHA256).Hash) {
            $findings += [PSCustomObject]@{ Type='File Hash'; Severity='CRITICAL'; Detail="PATCHCORD sample at $($_.FullName)" }
        }
    }
}

# --- 4. HackBrowserData / credential-dump artifacts ---
Get-ChildItem -Path $env:TEMP, "$env:USERPROFILE\Downloads" -Recurse -Include '*hack*browser*data*','browser_password*','decrypt_password*' -ErrorAction SilentlyContinue | ForEach-Object {
    $findings += [PSCustomObject]@{ Type='Credential Theft Tool'; Severity='CRITICAL'; Detail="Possible HackBrowserData artifact: $($_.FullName)" }
}

# --- 5. Suspicious persistence: run keys & scheduled tasks referencing temp/script paths ---
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
                 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' | ForEach-Object {
    $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|powershell.*-enc|rundll32' } | ForEach-Object {
        $findings += [PSCustomObject]@{ Type='Persistence'; Severity='HIGH'; Detail="Run key $($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'AppData|Temp|wscript|cscript|powershell' } | ForEach-Object {
    $findings += [PSCustomObject]@{ Type='Persistence'; Severity='MEDIUM'; Detail="Scheduled task '$($_.TaskName)' runs $($_.Actions.Execute)" }
}

# --- 6. Miasma v3: compromised AsyncAPI packages in node_modules ---
$Miasma = @('@asyncapi\generator','@asyncapi\generator-helpers','@asyncapi\generator-components','@asyncapi\specs')
Get-ChildItem -Path "$env:USERPROFILE" -Recurse -Directory -Filter 'node_modules' -Depth 4 -ErrorAction SilentlyContinue | ForEach-Object {
    foreach ($pkg in $Miasma) {
        $pkgPath = Join-Path $_.FullName $pkg
        if (Test-Path $pkgPath) {
            $findings += [PSCustomObject]@{ Type='Supply Chain'; Severity='CRITICAL'; Detail="AsyncAPI package present (verify version against July 2026 compromise): $pkgPath — ROTATE npm/SSH/CI secrets" }
        }
    }
}

# --- Report ---
if ($findings.Count -gt 0) {
    Write-Host "[!] $($findings.Count) finding(s) — isolate host and escalate to IR:" -ForegroundColor Red
    $findings | Sort-Object Severity | Format-Table -AutoSize
    $findings | Export-Csv -Path "$env:TEMP\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "[+] No IOC matches found on $env:COMPUTERNAME" -ForegroundColor Green
}