Phantom Stealer, Ousaban Banking Trojan, and TAG-182 MarkiRAT: OTX Pulse Analysis

title: Phantom Stealer PowerShell Loader and Shellcode Execution
id: 6635c89d-0e8a-4b2f-9a1c-1b8a0c9d2e3f
description: Detects PowerShell activity characteristic of Phantom Stealer loading, specifically the use of Add-Type, shellcode injection, or encoded commands often used in conjunction with steganography payloads.
status: experimental
author: Security Arsenal
date: 2026/07/31
references:
    - https://otx.alienvault.com/pulse/6635c89d-0e8a-4b2f-9a1c-1b8a0c9d2e3f
tags:
    - attack.execution
    - attack.t1059.001
    - attack.t1055
logsource:
    product: windows
    category: process_creation
detection:
    selection_pwsh:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'Add-Type'
            - 'System.Reflection.Assembly::Load'
            - 'VirtualAlloc'
            - '-EncodedCommand'
    selection_img_load:
        CommandLine|contains:
            - 'FromBase64String'
            - 'Invoke-Expression'
    filter_legit_admin:
        ParentImage|contains: '\System32\'
    condition: selection_pwsh and selection_img_load and not 1 of filter_legit_*
falsepositives:
    - Legitimate system administration scripts
level: high
---
title: Ousaban Banking Trojan VBS and Geofencing Activity
id: 7746d90e-1f9b-5c3g-0b2d-2c9b1d0e3f40
description: Detects the execution of VBS scripts followed by network connections characteristic of the Ousaban banking trojan distribution chain involving geo-checks and payload downloads.
status: experimental
author: Security Arsenal
date: 2026/07/31
references:
    - https://otx.alienvault.com/pulse/7746d90e-1f9b-5c3g-0b2d-2c9b1d0e3f40
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.command_and_control
    - attack.t1071.001
logsource:
    product: windows
    category: process_creation
detection:
    selection_vbs:
        Image|endswith:
            - '\wscript.exe'
            - '\cscript.exe'
        CommandLine|contains: '.vbs'
    selection_network:
        CommandLine|contains:
            - 'download'
            - 'http://'
            - 'https://'
            - 'Invoke-WebRequest'
    condition: selection_vbs and selection_network
falsepositives:
    - Legacy IT automation scripts
level: high
---
title: TAG-182 MarkiRAT C2 Infrastructure Connection
id: 8857e01f-2g0c-6d4h-1c3e-3d0c2e1f4g51
description: Detects network connections to known TAG-182 MarkiRAT Command and Control domains identified in OTX Pulse data.
status: experimental
author: Security Arsenal
date: 2026/07/31
references:
    - https://otx.alienvault.com/pulse/8857e01f-2g0c-6d4h-1c3e-3d0c2e1f4g51
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationHostname|contains:
            - 'yemplayer.site'
            - 'comi-site.website'
            - 'comesignt.website'
            - 'google.comesignt.website'
            - 'microsoft.comi-site.website'
    condition: selection_c2
falsepositives:
    - Unknown
level: critical


kql
// Hunt for Phantom Stealer and Ousaban File Hashes
DeviceProcessEvents
| where FolderPath endswith ".exe" or FolderPath endswith ".vbs" or FolderPath endswith ".ps1"
| where SHA256 in (
    "2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e", 
    "b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32",
    "be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab",
    "382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961",
    "790945e17a51691483455a11af2efcbe15f2b473b65b151f50287623d1468516",
    "528a46842744366b57edfc6fe2810ca7df43900db75126cd1c78f32957143364",
    "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3",
    "400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c"
)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName;

// Hunt for TAG-182 MarkiRAT Network Indicators
DeviceNetworkEvents
| where RemoteUrl in (
    "yemplayer.site",
    "comesignt.website"
)
| where RemoteUrl contains "comi-site.website" or RemoteUrl contains "comesignt.website" or RemoteUrl contains "google.comesignt.website"
| project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine;


powershell
# IOC Hunt Script for Phantom Stealer, Ousaban, and MarkiRAT Artifacts
# Requires Administrator Privileges

Write-Host "Starting Hunt for OTX Pulse Artifacts..." -ForegroundColor Cyan

# 1. Check for File Hash presence (Common download folders/user profiles)
$hashes = @(
    "2d5003d9318ae85eb22de99d19705a3cd7bf8e5c3349df979dfb3bdfa080908e",
    "b588caa5365451a6c60fd73fec5b73f13ac41bcc2a3a3bed7244df5917a62f32",
    "be119a21bedc3a79bf4dea8bcf5adf18304997a01ea23e276b9c31be37b789ab",
    "382233c398cbc35dcee845ee17046815f37588a382a8106bfb9b0252ea803961",
    "790945e17a51691483455a11af2efcbe15f2b473b65b151f50287623d1468516",
    "528a46842744366b57edfc6fe2810ca7df43900db75126cd1c78f32957143364",
    "d4eb4ff02df659fdeec17d36b77084627469623bb3c7d16383d257404b52d1c3",
    "400eb6a94810323a1fc5f8ab31c682fe765aaec2cc61b37c31d719c7e45c9a6c"
)

$pathsToScan = @("C:\Users\", "C:\ProgramData\", "C:\Windows\Temp")

Write-Host "Scanning for known malicious file hashes..."
foreach ($path in $pathsToScan) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($hashes -contains $hash) {
                Write-Host "[MATCH] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}

# 2. Check for Suspicious Persistence (Run Keys)
Write-Host "Checking Registry Run Keys for suspicious persistence..."
$runKeys = @(
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

$suspiciousPatterns = @("discord", "telegram", "crypto", "wallet", "update", "microsoft-edge")

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | Get-Member -MemberType NoteProperty | ForEach-Object {
            $valueName = $_.Name
            $valueData = (Get-ItemProperty -Path $key).$valueName
            foreach ($pattern in $suspiciousPatterns) {
                if ($valueData -match $pattern) {
                    Write-Host "[SUSPICIOUS] Potential persistence in $key : $valueName -> $valueData" -ForegroundColor Yellow
                }
            }
        }
    }
}

# 3. Check Hosts File for MarkiRAT C2 Domains
Write-Host "Checking HOSTS file for MarkiRAT domains..."
$hostsPath = "C:\Windows\System32\drivers\etc\hosts"
$maliciousDomains = @(
    "yemplayer.site",
    "comi-site.website",
    "comesignt.website",
    "google.comesignt.website",
    "microsoft.comi-site.website"
)

if (Test-Path $hostsPath) {
    $hostsContent = Get-Content $hostsPath
    foreach ($domain in $maliciousDomains) {
        if ($hostsContent -match $domain) {
            Write-Host "[MATCH] Malicious domain found in HOSTS file: $domain" -ForegroundColor Red
        }
    }
}

Write-Host "Hunt Complete."