Shadow-HVNC Loader Kit + Operation ASTERIX & Fake AML Checker Crypto-Drain Campaigns: OTX Pulse Detection Pack

---
title: Shadow Loader HVNC Process Injection into Browser or Explorer
id: 7f3a1b2e-9c4d-4e1a-a5f6-2b8c9d0e1f34
status: experimental
description: Detects suspicious child process or injection behavior consistent with Shadow Loader injecting Shadow-HVNC into explorer.exe or browser processes to establish hidden VNC sessions for crypto theft.
author: Security Arsenal Threat Intelligence
references:
    - https://malbearlabs.com/shadow-hvnc-and-shadow-loader-the-kit-that-protects-its-license-better-than-its-customers-dd99520b6af3
logsource:
    category: process_creation
    product: windows
level: high
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\rundll32.exe'
            - '\regsvr32.exe'
            - '\powershell.exe'
            - '\wscript.exe'
    filter_update:
        CommandLine|contains:
            - 'update.microsoft.com'
            - 'googleupdate'
    condition: selection_parent and selection_child and not filter_update
falsepositives:
    - Browser updaters and legitimate extension hosts
fields:
    - Image
    - ParentImage
    - CommandLine
    - ParentCommandLine
tags:
    - attack.defense_evasion
    - attack.t1055
    - attack.t1219
    - attack.t1021
---
title: Seed Phrase Exfiltration via Telegram Bot API from Non-Telegram Process
id: 2c8d4e5f-1a6b-4c7d-8e9f-3a4b5c6d7e89
status: experimental
description: Detects network connections to api.telegram.org from processes other than the Telegram desktop client, consistent with Operation ASTERIX seed phrase and credential exfiltration from fake Ledger/Trezor/Exodus wallet apps.
author: Security Arsenal Threat Intelligence
references:
    - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/
logsource:
    category: network_connection
    product: windows
level: high
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'api.telegram.org'
            - 't.me'
    filter_legit:
        Image|endswith:
            - '\Telegram.exe'
            - '\Telegram Desktop.exe'
    condition: selection_domain and not filter_legit
falsepositives:
    - Legitimate automation scripts using Telegram bots for IT notifications
fields:
    - Image
    - DestinationHostname
    - DestinationIp
    - DestinationPort
tags:
    - attack.exfiltration
    - attack.t1567
    - attack.t1102
    - attack.t1656
---
title: Fake Cryptocurrency Wallet or AML Checker Application Execution
id: 9e1f2a3b-4c5d-6e7f-8a9b-0c1d2e3f4a56
status: experimental
description: Detects execution of Electron-based or unsigned binaries masquerading as Ledger, Trezor, Exodus wallet applications or AML checker tools, as distributed by Operation ASTERIX and GhostDesk-related fake AML checker campaigns.
author: Security Arsenal Threat Intelligence
references:
    - https://www.rapid7.com/blog/post/tr-operation-asterix-crypto-fraud-vishing-phishing/
    - https://www.malwarebytes.com/blog/threat-intel/2026/08/scammers-are-using-fake-crypto-aml-checkers-to-drain-your-wallet
logsource:
    category: process_creation
    product: windows
level: critical
detection:
    selection_name:
        Image|contains:
            - 'ledger'
            - 'trezor'
            - 'exodus'
            - 'aml'
            - 'wallet'
    selection_path:
        Image|contains:
            - '\Downloads\'
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\AppData\Roaming\'
    filter_official:
        Image|startswith:
            - 'C:\Program Files\Ledger Live\'
            - 'C:\Program Files\Exodus\'
            - 'C:\Program Files (x86)\Trezor\'
    condition: selection_name and selection_path and not filter_official
falsepositives:
    - Users installing legitimate wallet software from Downloads folder before moving to Program Files
fields:
    - Image
    - CommandLine
    - Hashes
    - User
tags:
    - attack.initial_access
    - attack.t1204
    - attack.t1036
    - attack.t1656
date: 2026/08/20

let BadDomains = dynamic(["ledgerhelp.com", "bitget-aml.com", "search-aml.net", "amlbot-clear.com", "audittrust.shop"]);
let BadHashes = dynamic(["e857298fd2f8d1c7d48780769433f33e7b3ceaae5ea5a74c13ce8c10bcc7b690",
  "7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8",
  "0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f",
  "4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8",
  "7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a",
  "918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2",
  "961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176",
  "ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19"]);
let NetworkHits =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d)
    | where RemoteUrl has_any (BadDomains)
       or RemoteIP == "136.0.213.184"
       or (RemoteUrl has "api.telegram.org" and InitiatingProcessFileName !~ "Telegram.exe")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort;
let HashHits =
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where SHA256 in~ (BadHashes) or MD5 in~ ("1d04536714bb22a3e909525a7dd627f0","85c5a390f17891eee01d5fd10f20a98d","9675c957a5fded266939e314abff2078")
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, AccountName;
union NetworkHits, HashHits
| sort by TimeGenerated desc

# Security Arsenal - Shadow-HVNC / Operation ASTERIX / Fake AML IOC Hunt
# Run elevated on suspected endpoints. Output: console + CSV to $env:TEMP\ioc_hunt_results.csv

$results = @()

# 1. Active connections to ASTERIX enumeration host or suspicious high ports
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object {
    $_.RemoteAddress -eq "136.0.213.184" -or $_.RemotePort -in @(1337, 4444, 6666)
}
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $results += [PSCustomObject]@{
        Check  = "Network Connection"
        Detail = "$($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort) [$($proc.ProcessName)]"
        Risk   = "HIGH"
    }
}

# 2. Run-key persistence pointing to user-writable paths (Shadow Loader style)
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match "AppData|Temp|Users\\Public" -and $_.Name -notmatch "^PS"
            } | ForEach-Object {
                $results += [PSCustomObject]@{
                    Check  = "Run Key Persistence"
                    Detail = "$key\$($_.Name) = $($_.Value)"
                    Risk   = "HIGH"
                }
            }
        }
    }
}

# 3. Scheduled tasks executing from temp/roaming paths
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Where-Object { $_.Execute -match "AppData|Temp|Users\\Public" }
    if ($actions) {
        $results += [PSCustomObject]@{
            Check  = "Scheduled Task"
            Detail = "$($_.TaskName): $($actions.Execute)"
            Risk   = "MEDIUM"
        }
    }
}

# 4. Fake wallet / AML-branded executables in user-writable locations
$patterns = "*ledger*","*trezor*","*exodus*","*aml*","*wallet*"
$paths = "$env:USERPROFILE\Downloads", "$env:TEMP", "C:\Users\Public", "$env:APPDATA"
foreach ($p in $paths) {
    if (Test-Path $p) {
        foreach ($pat in $patterns) {
            Get-ChildItem -Path $p -Filter "$pat.exe" -Recurse -Depth 3 -ErrorAction SilentlyContinue | ForEach-Object {
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                $results += [PSCustomObject]@{
                    Check  = "Fake Wallet/AML Binary"
                    Detail = "$($_.FullName) SHA256=$hash"
                    Risk   = "CRITICAL"
                }
            }
        }
    }
}

# 5. Known Shadow Loader / ASTERIX file hashes on disk (quick hash sweep of Downloads and Temp)
$badHashes = @("E857298FD2F8D1C7D48780769433F33E7B3CEAAE5EA5A74C13CE8C10BCC7B690",
               "7E7DF0E30B6ABA8637FB58DB0A2E7A876890B872F0D0B313424D46C9299580E8")
Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
    $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
    if ($badHashes -contains $h) {
        $results += [PSCustomObject]@{
            Check  = "Known Malicious Hash"
            Detail = "$($_.FullName) SHA256=$h"
            Risk   = "CRITICAL"
        }
    }
}

if ($results.Count -gt 0) {
    $results | Format-Table -AutoSize
    $results | Export-Csv "$env:TEMP\ioc_hunt_results.csv" -NoTypeInformation
    Write-Host "[+] $($results.Count) findings exported to $env:TEMP\ioc_hunt_results.csv" -ForegroundColor Yellow
} else {
    Write-Host "[-] No IOC matches found on this host." -ForegroundColor Green
}