Star Blizzard SPICA Malware & PHP2Shell Extortion: OTX Pulse Analysis — Prediction Market Fraud Infrastructure Detection

---
title: Star Blizzard SPICA Malware Registry Persistence
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects registry run key modifications associated with SPICA malware persistence mechanisms
author: Security Arsenal Threat Intelligence
date: 2026/10/30
references:
    - https://www.cyfirma.com/research/adversary-unmasked-apt-profile-star-blizzard/
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        EventType: SetValue
        TargetObject|contains:
            - '\Software\Microsoft\Windows\CurrentVersion\Run'
            - '\Software\Microsoft\Windows\CurrentVersion\RunOnce'
    filter:
        Image|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection and not filter
fields:
    - Image
    - TargetObject
    - Details
tags:
    - attack.persistence
    - attack.t1547.001
    - attack.t1112
falsepositives:
    - Legitimate software installations
    - System administrator activity
level: high
---
title: EvilGinx Adversary-in-the-Middle DNS Query
id: 8b9c0d1e-2f3a-4b5c-6d7e-8f9a0b1c2d3e
status: experimental
description: Detects DNS queries to known EvilGinx phishing infrastructure
author: Security Arsenal Threat Intelligence
date: 2026/10/30
logsource:
    category: dns
detection:
    selection:
        query|contains:
            - 'preentootmist.org'
            - 'captchanom.top'
    condition: selection
fields:
    - query
    - answer
    - src_ip
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1566.002
falsepositives:
    - Security research activity
level: critical
---
title: PHP2Shell Web Shell Process Execution
id: 9c0d1e2f-3a4b-5c6d-7e8f-9a0b1c2d3e4f
status: experimental
description: Detects suspicious process execution patterns from PHP web shell activity
author: Security Arsenal Threat Intelligence
date: 2026/10/30
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\php.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\whoami.exe'
            - '\net.exe'
            - '\ipconfig.exe'
    condition: selection
fields:
    - ParentImage
    - Image
    - CommandLine
    - User
tags:
    - attack.execution
    - attack.t1059
    - attack.t1505.003
falsepositives:
    - Legitimate PHP administrative scripts
    - Web application deployment
level: high

// Hunt for Star Blizzard SPICA malware and PHP2Shell activity
let StarBlizzardIPs = dynamic(["103.245.231.248"]);
let StarBlizzardDomains = dynamic(["preentootmist.org", "captchanom.top"]);
let PHP2ShellIP = "96.126.130.81";
let SPICA_Hash = "87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48";
union isfuzzy=true
    (DeviceNetworkEvents
    | where RemoteIP in~ (StarBlizzardIPs) or RemoteUrl has_any (StarBlizzardDomains)
    | project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine),
    (DeviceProcessEvents
    | where FileName =~ "php.exe" and ProcessCommandLine has_any ("eval", "assert", "base64_decode")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, FolderPath),
    (DeviceFileEvents
    | where SHA256 == SPICA_Hash
    | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256),
    (DeviceRegistryEvents
    | where RegistryKey has_any ("Run", "RunOnce") and RegistryValueName matches regex @"^[a-zA-Z0-9]{8,16}$"
    | project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData)
| sort by TimeGenerated desc
| extend Campaign = case(
    RemoteIP in~ (StarBlizzardIPs) or RemoteUrl has_any (StarBlizzardDomains), "StarBlizzard",
    RemoteIP == PHP2ShellIP or FileName =~ "php.exe", "PHP2Shell",
    SHA256 == SPICA_Hash, "SPICA_Malware",
    "Unknown"
)
| summarize count() by Campaign, DeviceName, TimeGenerated
| order by count_ desc

#Requires -RunAsAdministrator
# Security Arsenal - Star Blizzard & PHP2Shell IOC Hunt Script
# Usage: Run on endpoints via RMM or GPO, output to SIEM collector

$ErrorActionPreference = 'SilentlyContinue'
$timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
$hostname = $env:COMPUTERNAME
$results = @()

# Star Blizzard IOCs
$sbIPs = @("103.245.231.248")
$sbDomains = @("preentootmist.org", "captchanom.top")
$sbHashes = @("87138f63974a8ccbbf5840c31165f1a4bf92a954bacccfbf1e7e5525d750aa48")

# PHP2Shell IOCs
$phpIP = "96.126.130.81"

Write-Host "[$timestamp] Starting IOC hunt on $hostname" -ForegroundColor Cyan

# Check network connections
$netstat = Get-NetTCPConnection -State Established
foreach ($conn in $netstat) {
    if ($sbIPs -contains $conn.RemoteAddress -or $conn.RemoteAddress -eq $phpIP) {
        $proc = Get-Process -Id $conn.OwningProcess
        $results += [PSCustomObject]@{
            Type = "Network_Connection"
            Severity = "CRITICAL"
            IOC = $conn.RemoteAddress
            Details = "Process: $($proc.ProcessName) (PID: $($proc.Id)), Local: $($conn.LocalAddress):$($conn.LocalPort)"
            Campaign = if ($sbIPs -contains $conn.RemoteAddress) { "StarBlizzard" } else { "PHP2Shell" }
        }
    }
}

# Check DNS cache
$dnsCache = Get-DnsClientCache
foreach ($entry in $dnsCache) {
    if ($sbDomains -contains $entry.Entry) {
        $results += [PSCustomObject]@{
            Type = "DNS_Cache"
            Severity = "HIGH"
            IOC = $entry.Entry
            Details = "Data: $($entry.Data), Status: $($entry.Status)"
            Campaign = "StarBlizzard"
        }
    }
}

# Check registry run keys
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)

foreach ($key in $runKeys) {
    if (Test-Path $key) {
        $values = Get-ItemProperty -Path $key
        foreach ($prop in $values.PSObject.Properties) {
            if ($prop.Name -match '^[a-zA-Z0-9]{8,16}$' -and $prop.Value -match '\.exe|\.dll') {
                $results += [PSCustomObject]@{
                    Type = "Registry_Persistence"
                    Severity = "MEDIUM"
                    IOC = "$key\$($prop.Name)"
                    Details = "Value: $($prop.Value)"
                    Campaign = "Unknown"
                }
            }
        }
    }
}

# Check scheduled tasks
$tasks = Get-ScheduledTask | Where-Object {$_.TaskPath -notlike "\Microsoft*"}
foreach ($task in $tasks) {
    $info = Get-ScheduledTaskInfo -TaskName $task.TaskName -TaskPath $task.TaskPath
    if ($info.LastRunTime -gt (Get-Date).AddDays(-7)) {
        $results += [PSCustomObject]@{
            Type = "Scheduled_Task"
            Severity = "LOW"
            IOC = $task.TaskName
            Details = "Path: $($task.TaskPath), Last Run: $($info.LastRunTime)"
            Campaign = "Unknown"
        }
    }
}

# Check for SPICA hash in common locations
$searchPaths = @("$env:TEMP", "$env:APPDATA", "$env:LOCALAPPDATA", "C:\Users\Public")
foreach ($path in $searchPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | 
        Select-Object -First 1000 | 
        ForEach-Object {
            $hash = Get-FileHash -Path $_.FullName -Algorithm SHA256
            if ($sbHashes -contains $hash.Hash) {
                $results += [PSCustomObject]@{
                    Type = "File_Hash_Match"
                    Severity = "CRITICAL"
                    IOC = $hash.Hash
                    Details = "Path: $($_.FullName), Size: $($_.Length) bytes"
                    Campaign = "SPICA"
                }
            }
        }
    }
}

# Output results
if ($results.Count -gt 0) {
    Write-Host "`n[ALERT] $($results.Count) IOC matches found!" -ForegroundColor Red
    $results | Format-Table -AutoSize
    $results | Export-Csv -Path "$env:TEMP\IOC_Hunt_$hostname_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
} else {
    Write-Host "[OK] No IOC matches detected" -ForegroundColor Green
}

# Return for SIEM ingestion
return $results