Redis Cryptomining Botnet (3,562 Compromised Servers) + Hagaseca Android RAT Loader: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Redis Rogue Replication or Unauthenticated Exploitation Activity
id: 7f2a1c4e-9b3d-4e5a-a6c1-redis000001
status: experimental
description: Detects Redis exploitation patterns including rogue replication (SLAVEOF/REPLICAOF), config rewriting, and module loading consistent with cryptomining botnet compromise (XMRig/Meterpreter delivery)
author: Security Arsenal Threat Intelligence
date: 2026/09/10
references:
  - https://hunt.io/blog/redis-cryptomining-botnet-3562-servers
logsource:
  category: process_creation
  product: linux
detection:
  selection_cli:
    CommandLine|contains:
      - 'SLAVEOF'
      - 'REPLICAOF'
      - 'CONFIG SET dir'
      - 'CONFIG SET dbfilename'
      - 'MODULE LOAD'
  selection_redis_write:
    CommandLine|contains:
      - '/var/spool/cron'
      - 'authorized_keys'
      - '/etc/cron.d'
  condition: selection_cli or selection_redis_write
falsepositives:
  - Legitimate Redis administration and cluster replication setup
level: high
tags:
  - attack.t1190
  - attack.t1053.003
  - attack.t1496
---
title: Cron-Based Persistence Followed by Miner or Meterpreter Execution
id: 7f2a1c4e-9b3d-4e5a-a6c1-redis000002
status: experimental
description: Detects cron job creation/modification followed by execution of XMRig miner or Meterpreter artifacts, or download of payloads from known campaign infrastructure (ayakliborsa.net)
author: Security Arsenal Threat Intelligence
date: 2026/09/10
references:
  - https://hunt.io/blog/redis-cryptomining-botnet-3562-servers
logsource:
  category: process_creation
  product: linux
detection:
  selection_miner:
    - CommandLine|contains:
        - 'xmrig'
        - 'stratum+tcp'
        - 'stratum+ssl'
        - '--donate-level'
        - 'monero'
    - Image|endswith:
        - '/xmrig'
  selection_download_c2:
    CommandLine|contains:
      - 'ayakliborsa.net'
      - '213.6.207.123'
      - '188.245.99.156'
  selection_cron_exec:
    ParentImage|endswith:
      - '/cron'
      - '/crond'
    Image|endswith:
      - '/curl'
      - '/wget'
      - '/sh'
      - '/bash'
  condition: selection_miner or selection_download_c2 or selection_cron_exec
falsepositives:
  - Legitimate mining operations (rare in enterprise)
  - Cron-based administrative downloads
level: critical
tags:
  - attack.t1496
  - attack.t1053.003
  - attack.t1105
---
title: Android ADB Exposure and Hagaseca RAT Network Indicators
id: 7f2a1c4e-9b3d-4e5a-a6c1-adbrat00003
status: experimental
description: Detects network connections to Hagaseca C2 infrastructure and ipapi.is fingerprinting from Android/Redroid device subnets, plus ADB service exposure on TCP/5555
author: Security Arsenal Threat Intelligence
date: 2026/09/10
references:
  - https://darkatlas.io/blog/hagaseca-inside-a-packed-android-rat-loader
logsource:
  category: network_connection
  product: windows
  # Deploy equivalent logic on Zeek/firewall logs for Android VLANs
detection:
  selection_c2_domain:
    DestinationHostname|contains:
      - 'hagaseca.com'
  selection_fingerprint:
    DestinationHostname: 'api.ipapi.is'
  selection_adb_port:
    DestinationPort: 5555
  condition: selection_c2_domain or (selection_fingerprint and selection_adb_port)
falsepositives:
  - api.ipapi.is queried by legitimate apps; correlation with ADB traffic raises fidelity
level: high
tags:
  - attack.t1071.001
  - attack.t1046

// Security Arsenal — Redis Botnet + Hagaseca RAT Hunt (Microsoft Sentinel)
// Lookback: 14 days
let Lookback = 14d;
let BadDomains = dynamic(["ayakliborsa.net", "socket.ayakliborsa.net", "hagaseca.com"]);
let BadIPs = dynamic(["188.245.99.156", "213.6.207.123"]);
let BadHashes = dynamic([
  "f90c8b1dcd374d4f552744ee1765583d",
  "420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a",
  "bdca0eb738faaccb5b992d0f393b9d9f",
  "c6ee3d72053772bdce063c5b98afe32e739e918e",
  "54d4ee85175a249dcb576716edf491d09fa05dfdfc492ff710a0cb711f9a35ab",
  "24f344e174546e780332d573d5a27c43",
  "dfd9c7dee4f4a16d636917de35a510b7",
  "03fc9c35d6453ccf7dd5d16ea2d6d272da1e1cae"
]);
// Part 1: Network IOC hits — C2, toolkit host, mining infrastructure
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteIP in (BadIPs) or RemoteUrl has_any (BadDomains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
// Part 2: File hash hits on dropped payloads
let HashHits = DeviceFileEvents
| where TimeGenerated > ago(Lookback)
| where MD5 in (BadHashes) or SHA1 in (BadHashes) or SHA256 in (BadHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5;
// Part 3: Behavioral — Redis exploitation, cron injection, miner execution
let BehaviorHits = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where ProcessCommandLine has_any ("SLAVEOF", "REPLICAOF", "CONFIG SET dir", "MODULE LOAD", "xmrig", "stratum+")
   or (InitiatingProcessFileName has_any ("cron", "crond") and FileName in~ ("curl", "wget", "sh", "bash"))
   or ProcessCommandLine has_any ("/var/spool/cron", "authorized_keys")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
// Part 4: Android/Redroid fingerprinting correlation (ipapi.is from non-browser processes)
let AndroidFingerprint = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl == "api.ipapi.is"
| where InitiatingProcessFileName !has_any ("chrome", "firefox", "edge", "msedge")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP;
union NetHits, HashHits, BehaviorHits, AndroidFingerprint
| sort by TimeGenerated desc

#!/bin/bash
# Security Arsenal — Redis Cryptomining Botnet IOC Hunt (Linux servers)
# Run on any host running Redis or suspected of compromise
# Usage: sudo bash redis_botnet_hunt.sh

echo "[+] Security Arsenal Redis Botnet Hunt — $(date)"

BAD_IPS="188.245.99.156 213.6.207.123"
BAD_DOMAINS="ayakliborsa.net socket.ayakliborsa.net hagaseca.com"
BAD_MD5="f90c8b1dcd374d4f552744ee1765583d"
BAD_SHA256="420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a"

echo ""
echo "=== [1] Redis rogue replication / module state ==="
if command -v redis-cli &>/dev/null; then
  redis-cli INFO replication 2>/dev/null | grep -Ei 'role|master_host|slave' && \
    echo "[!] Review above: unexpected 'role:slave' or foreign master_host = rogue replication"
  redis-cli MODULE LIST 2>/dev/null | grep -v '^$' && \
    echo "[!] Any loaded module on an internet-facing Redis is highly suspicious"
  redis-cli CONFIG GET dir 2>/dev/null
  redis-cli CONFIG GET dbfilename 2>/dev/null
else
  echo "[-] redis-cli not present on this host"
fi

echo ""
echo "=== [2] Cron injection artifacts (persistence) ==="
for f in /var/spool/cron/* /var/spool/cron/crontabs/* /etc/cron.d/*; do
  [ -f "$f" ] || continue
  if grep -qiE 'curl|wget|xmrig|stratum|base64|ayakliborsa|188\.245\.99\.156|213\.6\.207\.123' "$f" 2>/dev/null; then
    echo "[!] SUSPICIOUS CRON: $f"
    grep -iE 'curl|wget|xmrig|stratum|base64' "$f"
  fi
done

echo ""
echo "=== [3] XMRig / miner processes and files ==="
ps aux | grep -iE 'xmrig|stratum|monero|miner' | grep -v grep && echo "[!] Miner process running"
find /tmp /var/tmp /dev/shm /opt -maxdepth 3 -type f \( -name 'xmrig*' -o -name '*miner*' -o -name 'config.json' \) 2>/dev/null

echo ""
echo "=== [4] Active connections to campaign infrastructure ==="
for ip in $BAD_IPS; do
  ss -tnp 2>/dev/null | grep "$ip" && echo "[!] ACTIVE CONNECTION to $ip"
done

echo ""
echo "=== [5] Historical network/DNS evidence ==="
grep -rE "$BAD_DOMAINS" /var/log/ 2>/dev/null | head -20
journalctl --since "14 days ago" 2>/dev/null | grep -iE 'xmrig|redis|stratum|ayakliborsa' | head -20

echo ""
echo "=== [6] Hash check on suspicious binaries ==="
for f in $(find /tmp /var/tmp /dev/shm -type f -executable 2>/dev/null | head -100); do
  h256=$(sha256sum "$f" 2>/dev/null | awk '{print $1}')
  hm5=$(md5sum "$f" 2>/dev/null | awk '{print $1}')
  [ "$h256" == "$BAD_SHA256" ] && echo "[!] SHA256 MATCH: $f"
  [ "$hm5" == "$BAD_MD5" ] && echo "[!] MD5 MATCH: $f"
done

echo ""
echo "=== [7] SSH authorized_keys tampering ==="
for k in /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys; do
  [ -f "$k" ] || continue
  recent=$(find "$k" -mtime -14 2>/dev/null)
  [ -n "$recent" ] && echo "[!] $k modified in last 14 days — verify contents"
done

echo ""
echo "[+] Hunt complete. Escalate any [!] findings to the IR team."