---
title: Phantom Stealer PowerShell Execution Pattern
id: 20260731-001
description: Detects PowerShell execution patterns often used by Phantom Stealer loaders involving downloading content and base64 decoding or reflection.
status: experimental
author: Security Arsenal
date: 2026/07/31
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'DownloadString'
            - 'IEX'
            - 'FromBase64String'
    condition: selection
falsepositives:
    - Administrative scripts
level: high
---
title: Ousaban VBS Steganography Download
id: 20260731-002
description: Detects VBS scripts downloading image files, a technique used by Ousaban to retrieve steganographic payloads.
status: experimental
author: Security Arsenal
date: 2026/07/31
tags:
    - attack.command_and_control
    - attack.t1105
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4688
        NewProcessName|endswith: '\wscript.exe'
        CommandLine|contains: '.vbs'
    filter:
        CommandLine|contains:
            - '.jpg'
            - '.png'
            - '.bmp'
            - '.jpeg'
    condition: selection and filter
falsepositives:
    - Low
level: high
---
title: PasasteSinTAG Phishing Domain Access
id: 20260731-003
description: Detects network connections to domains associated with the PasasteSinTAG phishing campaign targeting Chile.
status: experimental
author: Security Arsenal
date: 2026/07/31
tags:
    - attack.initial_access
    - attack.t1566.002
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'pasastesintag'
            - 'parastesintago'
    condition: selection
falsepositives:
    - Legitimate access to pasastesinTAG (verify context)
level: critical


kql
// Hunt for Phantom Stealer and Ousaban File Hashes
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    '2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e',
    'b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32',
    'd4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3'
) 
or MD5 in (
    '031ae066a8188e5fea8d3d7981a2166c',
    '18205d398e5df7d38705dbdc700ccb46',
    '62944e26b36b1dcace429ae26ba66164'
)
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, MD5, InitiatingProcessAccountName


powershell
# IOC Hunt Script for Phantom Stealer Persistence and Artifacts
# Requires Administrative Privileges

$MD5Hashes = @(
    "031ae066a8188e5fea8d3d7981a2166c",
    "18205d398e5df7d38705dbdc700ccb46",
    "26c0aee6c79935ee6da46e6444f1c109",
    "62944e26b36b1dcace429ae26ba66164"
)

$SHA256Hashes = @(
    "2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e",
    "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3",
    "23b122deea347dbe2407c1542c1cc6caaafca537eb5d1950a4ed7c8a69395dbb"
)

$Domains = @(
    "pasastesintag.pics",
    "laoshunfa.xyz",
    "gov-xnui.com",
    "confbase.mdpsupport.net"
)

Write-Host "[+] Hunting for Phantom Stealer and Ousaban IOCs..." -ForegroundColor Cyan

# Check File Hashes
Write-Host "[*] Checking file hashes on system drive..." -ForegroundColor Yellow
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Length -gt 0kb -and $_.Length -lt 10mb } | ForEach-Object {
    $fileHash = (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash.ToLower()
    if ($MD5Hashes -contains $fileHash) {
        Write-Host "[!] ALERT: Match found for MD5 $fileHash at $($_.FullName)" -ForegroundColor Red
    }
    $fileHash256 = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
    if ($SHA256Hashes -contains $fileHash256) {
        Write-Host "[!] ALERT: Match found for SHA256 $fileHash256 at $($_.FullName)" -ForegroundColor Red
    }
}

# Check Hosts File for Phishing Domains
Write-Host "[*] Checking hosts file for malicious domains..." -ForegroundColor Yellow
$HostsPath = "$env:windir\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
    $HostsContent = Get-Content $HostsPath
    foreach ($domain in $Domains) {
        if ($HostsContent -match $domain) {
            Write-Host "[!] WARNING: Domain $domain found in hosts file." -ForegroundColor Yellow
        }
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green


# Response Priorities

*   **Immediate**:
    *   Block all listed domains and file hashes at the perimeter, proxy, and endpoint levels.
    *   Hunt for the presence of `wscript.exe` launching image downloads or PowerShell performing base64 decoding.
*   **24 Hours**:
    *   If credential-theft malware (Phantom/Ousaban) is suspected, force a password reset for high-privilege accounts and users in targeted regions (Iberia, India, Chile, Central Asia).
    *   Review logs for access to the "PasasteSinTAG" spoof domains.
*   **1 Week**:
    *   Implement application-specific controls to block unsigned .NET binaries or macros from the internet.
    *   Conduct security awareness training focused on tax-season phishing and brand impersonation (PasasteSinTAG).
    *   Update geofencing policies to restrict access from non-corporate regions where applicable.