RemotePanel + BoundSiphon: ClickFix-Delivered Dual-Payload Toolkit for Persistent Access & Browser Credential Theft — OTX Detection Pack

---
title: Windows Service Installation Masquerading as Windows Time (RemotePanel Persistence)
id: 7c2f1a4e-9d3b-4c8a-a1f2-remotepanel01
status: experimental
description: Detects creation of Windows services mimicking W32Time display name or description, consistent with RemotePanel RAT persistence via service masquerade
references:
  - https://blackpointcyber.com/blog/remotepanel-and-boundsiphon-a-dual-payload-toolkit-for-persistent-access-and-browser-theft/
author: Security Arsenal Threat Intelligence
date: 2026/09/25
logsource:
  product: windows
  service: system
detection:
  selection_event:
    EventID: 7045
  selection_masquerade:
    ServiceName|contains:
      - 'Windows Time'
      - 'w32tim'
      - 'W32Time'
  filter_legitimate:
    ImagePath|contains:
      - 'svchost.exe -k LocalService'
      - 'C:\\Windows\\System32\\svchost.exe'
  condition: selection_event and selection_masquerade and not filter_legitimate
falsepositives:
  - Rare — legitimate W32Time runs from svchost under LocalService; any standalone service binary claiming Windows Time naming is suspicious
level: high
tags:
  - attack.persistence
  - attack.t1543.003
  - attack.t1036
---
title: ClickFix-Style User-Initiated Malicious Command Execution
id: 8d3a2b5f-1e4c-5d9b-b2a3-clickfix002
status: experimental
description: Detects mshta or PowerShell download cradles spawned directly from explorer.exe via the Run dialog, the hallmark of ClickFix social engineering delivery used to stage RemotePanel and BoundSiphon
references:
  - https://blackpointcyber.com/blog/remotepanel-and-boundsiphon-a-dual-payload-toolkit-for-persistent-access-and-browser-theft/
author: Security Arsenal Threat Intelligence
date: 2026/09/25
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\\explorer.exe'
  selection_child:
    Image|endswith:
      - '\\mshta.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'Invoke-Expression'
      - 'IEX'
      - 'FromBase64String'
      - '-enc '
      - '-w hidden'
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - IT admin ad-hoc troubleshooting; validate against helpdesk activity and user reports
level: high
tags:
  - attack.execution
  - attack.t1204.002
  - attack.t1059.001
  - attack.t1218.005
---
title: RemotePanel C2 Domain or Blockchain Dead-Drop Resolution Activity
id: 9e4b3c6a-2f5d-6e1c-c3b4-bnbresolve03
status: experimental
description: Detects DNS queries for known RemotePanel C2 domains or non-browser processes querying BNB Smart Chain public RPC endpoints used for smart-contract-based C2 dead-drop resolution
references:
  - https://blackpointcyber.com/blog/remotepanel-and-boundsiphon-a-dual-payload-toolkit-for-persistent-access-and-browser-theft/
author: Security Arsenal Threat Intelligence
date: 2026/09/25
logsource:
  category: dns
detection:
  selection_c2:
    query|contains:
      - 'greatgrgreeng.com'
      - 'leftsideegpeakk.com'
  selection_bnb_rpc:
    query|contains:
      - 'bsc-dataseed'
      - 'bsc-mainnet'
      - 'binance.org'
  condition: 1 of selection_*
falsepositives:
  - Legitimate Web3/cryptocurrency tooling in fintech environments; baseline before enforcing
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102

// RemotePanel / BoundSiphon hunt: ClickFix execution lineage, service masquerade, and C2/blockchain resolution
// Microsoft Sentinel — run over last 14 days, extend TimeGenerated window for retro-hunt
let c2Domains = dynamic(["greatgrgreeng.com", "leftsideegpeakk.com"]);
let bnbRpc = dynamic(["bsc-dataseed", "bsc-mainnet", "binance.org"]);
let suspiciousHashes = dynamic([
  "30f9387b6aa2dd249d93cec58786251a224faaec57673a4b8104a33a01dfe62b",
  "351f0d27d2f0105186446693eed5794419ad79d7e6e647fc2fe74dbffb25f9ad",
  "5060c8184993d5ac04701ffa2c1d30451e40a7b2dbfc084eceaabb5084704991",
  "a7e8c9e157d3ce37913a32aaa861b5248da4cc5288fa99a6b291524af5e3b9c6",
  "b7a5c52cedd9cd5425a7f85b8d3b4b869b805c70c7991375a2c4ab612ff7906d",
  "fec29bbd8e50b6635ef683f03f6e018c9627aa6362a2f167115424e50b8c1b10"]);
let clickfixExec =
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where InitiatingProcessFileName =~ "explorer.exe"
  | where FileName in~ ("mshta.exe", "powershell.exe", "pwsh.exe")
  | where ProcessCommandLine has_any ("http://", "https://", "IEX", "Invoke-Expression", "FromBase64String", "-enc")
  | project ClickFixTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256;
let c2Comms =
  DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteUrl has_any (c2Domains) or RemoteUrl has_any (bnbRpc)
  | where not(InitiatingProcessFileName in~ ("chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"))
  | project C2Time=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP;
let hashHits =
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where SHA256 has_any (suspiciousHashes)
  | project HashTime=TimeGenerated, DeviceName, FileName, FolderPath, SHA256, AccountName;
union clickfixExec, c2Comms, hashHits
| sort by DeviceName

# RemotePanel / BoundSiphon endpoint IOC hunt — run via EDR live response or GPO across fleet
# Checks: fake W32Time service, DNS cache for C2/blockchain resolution, run-key persistence, payload hashes

$Report = @()

# 1. Service masquerade: find services claiming Windows Time identity not running from svchost
$services = Get-CimInstance Win32_Service | Where-Object {
    ($_.DisplayName -match 'Windows Time' -or $_.Name -match 'w32tim') -and
    ($_.PathName -notmatch 'svchost')
}
foreach ($s in $services) {
    $Report += [PSCustomObject]@{Check='ServiceMasquerade'; Finding="$($s.Name) | $($s.PathName) | State:$($s.State)"; Host=$env:COMPUTERNAME}
}

# 2. DNS cache hits for C2 domains and BNB Smart Chain RPC dead-drop resolvers
$dnsHits = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match 'greatgrgreeng|leftsideegpeakk|bsc-dataseed|bsc-mainnet'
}
foreach ($d in $dnsHits) {
    $Report += [PSCustomObject]@{Check='DNSCache'; Finding="$($d.Entry) -> $($d.Data)"; Host=$env:COMPUTERNAME}
}

# 3. Run-key persistence referencing suspicious script interpreters
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    Get-ItemProperty -Path $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'mshta|powershell.*-enc|AppData.*\.exe' } | ForEach-Object {
            $Report += [PSCustomObject]@{Check='RunKey'; Finding="$key :: $($_.Name) = $($_.Value)"; Host=$env:COMPUTERNAME}
        }
    }
}

# 4. Payload hash sweep in common staging dirs
$hashes = @('30f9387b6aa2dd249d93cec58786251a224faaec57673a4b8104a33a01dfe62b',
            '351f0d27d2f0105186446693eed5794419ad79d7e6e647fc2fe74dbffb25f9ad',
            '5060c8184993d5ac04701ffa2c1d30451e40a7b2dbfc084eceaabb5084704991',
            'a7e8c9e157d3ce37913a32aaa861b5248da4cc5288fa99a6b291524af5e3b9c6',
            'b7a5c52cedd9cd5425a7f85b8d3b4b869b805c70c7991375a2c4ab612ff7906d',
            'fec29bbd8e50b6635ef683f03f6e018c9627aa6362a2f167115424e50b8c1b10')
$paths = @("$env:ProgramData", "$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA\Temp")
foreach ($p in $paths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($h -and ($hashes -contains $h.ToLower())) {
            $Report += [PSCustomObject]@{Check='HashMatch'; Finding="$($_.FullName) [$h]"; Host=$env:COMPUTERNAME}
        }
    }
}

# 5. Active connections to blockchain RPC endpoints from non-browser processes
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.Name -notmatch 'chrome|msedge|firefox|brave') {
        try {
            $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
            if ($rdns -match 'binance|bsc') {
                $Report += [PSCustomObject]@{Check='BlockchainC2'; Finding="$($proc.Name) ($($_.OwningProcess)) -> $($_.RemoteAddress):$($_.RemotePort) [$rdns]"; Host=$env:COMPUTERNAME}
            }
        } catch {}
    }
}

if ($Report.Count -gt 0) { $Report | Format-Table -AutoSize; $Report | Export-Csv "RemotePanel_Hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }
else { Write-Output "[+] No RemotePanel/BoundSiphon indicators found on $env:COMPUTERNAME" }