Psychedelic Stealer MSI Distribution via Fake CAPTCHA: OTX Pulse Analysis — Ukraine Targeting Detection Pack

---
title: Psychedelic Stealer - Suspicious MSI Remote Installation
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects msiexec.exe installing packages from remote URLs, consistent with Psychedelic Stealer fake CAPTCHA campaign
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/66ff5a4c3e2b1a0012345678
date: 2026/10/25
modified: 2026/10/25
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith: '\msiexec.exe'
    selection_cmd_url:
        CommandLine|contains:
            - 'http://'
            - 'https://'
    selection_cmd_params:
        CommandLine|contains:
            - '/i'
            - '/quiet'
            - '/qn'
            - '/passive'
    condition: selection_img and selection_cmd_url and selection_cmd_params
falsepositives:
    - Legitimate software deployment via URL (rare in enterprise environments)
    - SCCM/Intune package distribution (usually uses local paths or UNC shares)
level: high
tags:
    - attack.execution
    - attack.t1053
    - attack.t1204
    - psychedelic
    - clickfix
---
title: Psychedelic Stealer - Clipboard Manipulation via Browser
id: 8b7c6d5e-4f3a-2b1c-0d9e-8f7a6b5c4d3e
status: experimental
description: Detects suspicious clipboard access patterns potentially associated with ClickFix-style clipboard hijacking
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\iexplore.exe'
    selection_suspicious_parent:
        ParentImage|endswith:
            - '\explorer.exe'
    timeframe: 5m
    condition: selection_browser and selection_suspicious_parent
falsepositives:
    - Normal browser usage
    - Requires correlation with subsequent Run dialog activity
level: low
tags:
    - attack.collection
    - attack.t1115
    - psychedelic
---
title: Psychedelic Stealer - Run Dialog Execution of MSIExec
id: 7c6d5e4f-3a2b-1c0d-9e8f-7a6b5c4d3e2f
status: experimental
description: Detects msiexec execution with Run dialog (explorer.exe) as parent, indicative of user-pasted malicious commands
author: Security Arsenal Threat Intelligence
date: 2026/10/25
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_img:
        Image|endswith: '\msiexec.exe'
    selection_cmd:
        CommandLine|contains: 'http'
    filter_rundll32:
        CommandLine|contains: 'rundll32'
    condition: selection_parent and selection_img and selection_cmd and not filter_rundll32
falsepositives:
    - Software installation by administrators via Run dialog
level: critical
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204.002
    - psychedelic

// Psychedelic Stealer - Fake CAPTCHA Campaign Hunt
// Detects MSI execution from URLs and suspicious network connections to known C2
// Timeframe: Last 7 days
let timeframe = 7d;
// Hunt 1: Process execution - msiexec with remote URLs
let suspiciousMsiExec = DeviceProcessEvents
| where Timestamp > ago(timeframe)
| where FileName =~ "msiexec.exe"
| where ProcessCommandLine has_any ("http://", "https://")
| where InitiatingProcessFileName =~ "explorer.exe" // Run dialog parent
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, FileName, InitiatingProcessFileName, SHA256, FolderPath;
// Hunt 2: Network connections to known malicious domain
let c2Connections = DeviceNetworkEvents
| where Timestamp > ago(timeframe)
| where RemoteUrl has_any ("uasputnik.com") or RemoteIP in (dynamic([])) // Add resolved IPs as available
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
// Hunt 3: File creation of suspicious MSI files
let msiFiles = DeviceFileEvents
| where Timestamp > ago(timeframe)
| where FileName endswith ".msi"
| where FolderPath has_any ("AppData", "Temp", "Downloads")
| where SHA256 in ("06f434695f93d7fd11eeff71358ff69fed79d310a66d993bbcc4ff979c117c90", "38e90affe37342ee36917cdc535fe9bf04589afa8430eb8d1ba1016adcfc1878")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
// Combine results
union suspiciousMsiExec, c2Connections, msiFiles
| summarize arg_max(Timestamp, *) by DeviceName, FileName, RemoteUrl
| sort by Timestamp desc

# Psychedelic Stealer IOC Hunt Script
# Run with administrative privileges on suspected endpoints
# Checks for registry persistence, suspicious MSI artifacts, and network connections

Write-Host "[+] Starting Psychedelic Stealer Hunt..." -ForegroundColor Cyan

$results = @()

# 1. Check Registry Run Keys for suspicious entries
Write-Host "[*] Checking Registry Run Keys..." -ForegroundColor Yellow
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $entries = Get-ItemProperty -Path $key -ErrorAction SilentlyContinue
        foreach ($entry in $entries.PSObject.Properties) {
            if ($entry.Value -match "msiexec|http|uasputnik|elita") {
                $results += [PSCustomObject]@{
                    Type = "Registry Run Key"
                    Location = "$key\$($entry.Name)"
                    Value = $entry.Value
                    Risk = "High"
                }
            }
        }
    }
}

# 2. Check for suspicious MSI files in temp directories
Write-Host "[*] Checking for suspicious MSI files..." -ForegroundColor Yellow
$tempPaths = @($env:TEMP, "$env:LOCALAPPDATA\Temp", "$env:APPDATA", "C:\Windows\Temp")
foreach ($path in $tempPaths) {
    if (Test-Path $path) {
        $msiFiles = Get-ChildItem -Path $path -Filter "*.msi" -Recurse -ErrorAction SilentlyContinue | 
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
        
        foreach ($file in $msiFiles) {
            $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256).Hash
            if ($hash -in @("06F434695F93D7FD11EEFF71358FF69FED79D310A66D993BBCC4FF979C117C90", "38E90AFFE37342EE36917CDC535FE9BF04589AFA8430EB8D1BA1016ADCFC1878")) {
                $results += [PSCustomObject]@{
                    Type = "Malicious MSI File"
                    Location = $file.FullName
                    Value = "SHA256: $hash"
                    Risk = "Critical"
                }
            }
        }
    }
}

# 3. Check network connections to known C2
Write-Host "[*] Checking network connections..." -ForegroundColor Yellow
$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
Where-Object { $_.RemoteAddress -notmatch "^10\.|^172\.(1[6-9]|2[0-9]|3[01])\.|^192\.168\.|^127\." }

foreach ($conn in $connections) {
    $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    if ($proc.ProcessName -match "msiexec|powershell|cmd") {
        $results += [PSCustomObject]@{
            Type = "Suspicious Network Connection"
            Location = "$($conn.LocalAddress):$($conn.LocalPort) -> $($conn.RemoteAddress):$($conn.RemotePort)"
            Value = "Process: $($proc.ProcessName) (PID: $($proc.Id))"
            Risk = "Medium"
        }
    }
}

# 4. Check for recent msiexec execution events
Write-Host "[*] Checking Windows Event Logs for msiexec activity..." -ForegroundColor Yellow
$events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddDays(-2)} -ErrorAction SilentlyContinue | 
Where-Object { $_.Message -match "msiexec.*http" }

foreach ($event in $events) {
    $results += [PSCustomObject]@{
        Type = "Suspicious Process Execution"
        Location = "Event ID 4688"
        Value = $event.Message.Substring(0, [Math]::Min(200, $event.Message.Length)) + "..."
        Risk = "High"
    }
}

# Output results
if ($results.Count -gt 0) {
    Write-Host "`n[!] DETECTIONS FOUND:" -ForegroundColor Red
    $results | Format-Table -AutoSize
    $results | Export-Csv -Path "Psychedelic_Stealer_Hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[+] Results exported to CSV" -ForegroundColor Green
} else {
    Write-Host "`n[+] No indicators of Psychedelic Stealer found." -ForegroundColor Green
}

Write-Host "`n[*] Manual verification recommended: Check browser history for fake Cloudflare pages and clipboard contents (if accessible)." -ForegroundColor Cyan