pepesoft.exe Infostealer + ZBT Firmware Implants + XenoRAT Spear-Phishing: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Malicious NuGet Tool Execution - pepesoft Infostealer Downloader
id: 7a3f1c2e-9b4d-4e5a-8c1f-2d6e7f8a9b0c
status: experimental
description: Detects execution of dotnet CLI tools or pepesoft.exe payload associated with malicious NuGet game-cheat packages delivering a PyInstaller surveillance infostealer
author: Security Arsenal Threat Intelligence
date: 2026/08/28
references:
    - https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats
logsource:
    category: process_creation
    product: windows
level: high
tags:
    - attack.initial_access
    - attack.t1195_002
    - attack.execution
detection:
    selection_img:
        Image|endswith: 'pepesoft.exe'
    selection_dotnet:
        Image|endswith: 'dotnet.exe'
        CommandLine|contains:
            - 'tool install'
            - 'tool run'
    selection_cheat_lure:
        CommandLine|contains:
            - 'albion'
            - 'gta5rp'
            - 'grandrp'
            - 'throne and liberty'
            - 'cheat'
    condition: selection_img or (selection_dotnet and selection_cheat_lure)
falsepositives:
    - Legitimate game modding tools (rare in enterprise environments)
fields:
    - Image
    - CommandLine
    - ParentImage
    - User

---
title: DNS-over-HTTPS to Public Resolvers from Non-Browser Process
id: 8b4e2d3f-0c5e-5f6b-9d2e-3e7f8a9b0c1d
status: experimental
description: Detects non-browser processes making HTTPS connections to public DoH resolvers, a technique used by the pepesoft infostealer to bypass local DNS controls
author: Security Arsenal Threat Intelligence
date: 2026/08/28
references:
    - https://socket.dev/blog/11-malicious-nuget-tools-pose-as-game-cheats
logsource:
    category: network_connection
    product: windows
level: medium
tags:
    - attack.command_and_control
    - attack.t1071_001
    - attack.defense_evasion
detection:
    selection_dest:
        DestinationIp:
            - '1.1.1.1'
            - '1.0.0.1'
            - '8.8.8.8'
            - '8.8.4.4'
            - '9.9.9.9'
            - '94.140.14.14'
            - '94.140.15.15'
        DestinationPort: 443
    filter_browsers:
        Image|endswith:
            - 'chrome.exe'
            - 'msedge.exe'
            - 'firefox.exe'
            - 'brave.exe'
    condition: selection_dest and not filter_browsers
falsepositives:
    - VPN clients, some antivirus updaters using DoH
fields:
    - Image
    - DestinationIp
    - DestinationHostname
    - User

---
title: Kimsuky XenoRAT Delivery - LNK Spawning PowerShell or Curl Staging
id: 9c5f3e4a-1d6f-6a7c-0e3f-4f8a9b0c1d2e
status: experimental
description: Detects LNK-file execution chains spawning PowerShell, AutoIt, or curl.exe consistent with Kimsuky July 2026 spear-phishing campaigns delivering XenoRAT via cloud staging and DLL side-loading
author: Security Arsenal Threat Intelligence
date: 2026/08/28
references:
    - https://asec.ahnlab.com/en/95171
logsource:
    category: process_creation
    product: windows
level: high
tags:
    - attack.initial_access
    - attack.t1566_001
    - attack.t1204_002
    - attack.t1574_002
detection:
    selection_parent:
        ParentCommandLine|contains: '.lnk'
    selection_child:
        Image|endswith:
            - 'powershell.exe'
            - 'pwsh.exe'
            - 'curl.exe'
            - 'autoit3.exe'
            - 'rundll32.exe'
    selection_cloud:
        CommandLine|contains:
            - 'github.com'
            - 'raw.githubusercontent.com'
            - 'drive.google.com'
            - 'dropbox.com'
    condition: selection_parent and selection_child and selection_cloud
falsepositives:
    - IT admin shortcuts deploying scripts from repositories (rare)
fields:
    - Image
    - ParentCommandLine
    - CommandLine
    - User

// Hunt: pepesoft infostealer, wallet-drainer C2, ZBT implant beacons, and Kimsuky staging
// Covers: network IOCs, DoH evasion, LNK->LOLBins chains, WebSocket C2 domains
let MaliciousDomains = dynamic(["cookie-whitelist.com", "cookie-whitelist.top", "whale-alert.life",
    "api.extensionanalyticspro.top", "api.active-enable-right-click.top", "ggle-analytics.com",
    "blockfolioaddressmonitor.pro", "cryptopricebadgequickglance.pro", "www.ac-link.com"]);
let MaliciousIPs = dynamic(["47.107.224.89", "45.156.37.159"]);
let DoHResolvers = dynamic(["1.1.1.1", "1.0.0.1", "8.8.8.8", "8.8.4.4", "9.9.9.9"]);
let Browsers = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (MaliciousDomains)
       or RemoteIP in (MaliciousIPs)
       or (RemoteIP in (DoHResolvers) and not(InitiatingProcessFileName has_any (Browsers)))
    | extend DetectionType = case(
        RemoteIP in (MaliciousIPs), "ZBT Implant Beacon",
        RemoteUrl has_any (MaliciousDomains), "Wallet-Drainer/Implant C2",
        "DoH Evasion (pepesoft TTP)")
    | project DetectionType, TimeGenerated, DeviceName, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, AccountName;
let ProcessHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where FileName =~ "pepesoft.exe"
       or (ProcessCommandLine has ".lnk" and FileName in~ ("powershell.exe","curl.exe","autoit3.exe","rundll32.exe")
           and ProcessCommandLine has_any ("github.com","drive.google.com","dropbox.com"))
       or (FileName =~ "dotnet.exe" and ProcessCommandLine has_any ("cheat","albion","gta5rp","grandrp"))
    | extend DetectionType = case(
        FileName =~ "pepesoft.exe", "pepesoft Payload Execution",
        FileName =~ "dotnet.exe", "Malicious NuGet Tool",
        "Kimsuky LNK Staging Chain")
    | project DetectionType, TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessCommandLine, AccountName, SHA256;
union NetworkHits, ProcessHits
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse Hunt: pepesoft / XenoRAT / wallet-drainer artifacts
# Run elevated on suspect endpoints. Outputs findings to console + CSV.
$findings = @()

# --- 1. pepesoft payload & suspicious PyInstaller artifacts ---
$pepePaths = @("$env:TEMP\pepesoft.exe","$env:APPDATA\pepesoft.exe",
               "$env:LOCALAPPDATA\pepesoft.exe","$env:USERPROFILE\Downloads\pepesoft.exe")
foreach ($p in $pepePaths) {
    if (Test-Path $p) {
        $h = (Get-FileHash $p -Algorithm SHA256).Hash
        $findings += [PSCustomObject]@{Check="pepesoft payload file"; Path=$p; Detail=$h}
    }
}
# PyInstaller onefile extraction dirs (_MEIxxxxx) in TEMP
Get-ChildItem "$env:TEMP" -Directory -Filter "_MEI*" -ErrorAction SilentlyContinue | ForEach-Object {
    $findings += [PSCustomObject]@{Check="PyInstaller temp extraction dir"; Path=$_.FullName; Detail=$_.LastWriteTime}
}

# --- 2. Known malicious file hashes (OTX samples) ---
$badHashes = @("d5385526f2f3e52c7d96087611c6cd4e479bf61828400efdb3ca09406d981609",
               "9a2091e6625fc11cfd8f39c17aa271604e66322ee045028946274b988103e35b",
               "900ddb81d27e03967209fee4d17d13deb68eef0e1f10936eb520ca10575cb49e",
               "ab58a90eb3682c6dc3389cd700a64f68a19c0dac3d0fa8e3df97ae041f96d4e1",
               "e6e1049158ceb1971c61388349c81fa6047a7aecb4ff2089ef54a50dcc35dbc0")
foreach ($dir in @($env:TEMP,$env:APPDATA,"$env:USERPROFILE\Downloads")) {
    Get-ChildItem $dir -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue |
        Where-Object {$_.Length -lt 100MB} | ForEach-Object {
            $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($badHashes -contains $h) {
                $findings += [PSCustomObject]@{Check="KNOWN MALICIOUS HASH"; Path=$_.FullName; Detail=$h}
            }
        }
}

# --- 3. Persistence: Run keys & scheduled tasks referencing pepesoft/NuGet lures ---
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    Get-ItemProperty $rk -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {$_.Value -match "pepesoft|cheat|albion|gta5rp|grandrp"} | ForEach-Object {
            $findings += [PSCustomObject]@{Check="Suspicious Run key"; Path="$rk\$($_.Name)"; Detail=$_.Value}
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute -match "pepesoft|dotnet") -or ($_.TaskName -match "cheat|albion|gta5rp")
} | ForEach-Object {
    $findings += [PSCustomObject]@{Check="Suspicious scheduled task"; Path=$_.TaskName; Detail=$_.Actions.Execute}
}

# --- 4. Network: connections to implant C2 IPs and drainer domains ---
$badIPs = @("47.107.224.89","45.156.37.159")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object {$badIPs -contains $_.RemoteAddress} | ForEach-Object {
        $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
        $findings += [PSCustomObject]@{Check="ACTIVE connection to implant C2"; Path=$_.RemoteAddress; Detail="PID $($_.OwningProcess) ($proc)"}
    }

# --- 5. DoH evasion check: non-browser processes resolving via public DoH ---
Get-NetTCPConnection -RemotePort 443 -State Established -ErrorAction SilentlyContinue |
    Where-Object {@("1.1.1.1","8.8.8.8","9.9.9.9") -contains $_.RemoteAddress} | ForEach-Object {
        $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
        if ($proc -notmatch "chrome|msedge|firefox|brave") {
            $findings += [PSCustomObject]@{Check="Non-browser DoH connection"; Path=$_.RemoteAddress; Detail="$proc (PID $($_.OwningProcess))"}
        }
    }

# --- 6. Recent LNK files in user profile (Kimsuky delivery vector) ---
Get-ChildItem "$env:USERPROFILE\Desktop","$env:USERPROFILE\Downloads" -Filter *.lnk -ErrorAction SilentlyContinue |
    Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-30)} | ForEach-Object {
        $findings += [PSCustomObject]@{Check="Recent LNK file (review)"; Path=$_.FullName; Detail=$_.LastWriteTime}
    }

# --- Output ---
if ($findings.Count -gt 0) {
    $findings | Format-Table -AutoSize
    $findings | Export-Csv -Path "$env:TEMP\otx_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[!] $($findings.Count) findings - escalate to SOC for triage." -ForegroundColor Red
} else {
    Write-Host "[+] No indicators found on this host." -ForegroundColor Green
}