XenoRAT, BTMOB, and The Gentlemen: OTX Pulse Analysis — Enterprise Detection Pack

---
title: SideCopy APT - Suspicious mshta.exe Execution via LNK
id: 5c7f3c91-8a2b-4b5d-9c1e-2f3a4b5c6d7e
description: Detects SideCopy activity where a LNK file spawns mshta.exe, a common pattern in their XenoRAT delivery.
status: experimental
date: 2026/06/01
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64234d231234
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\explorer.exe'
        Image|endswith: '\mshta.exe'
        CommandLine|contains: '.hta'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high
tags:
    - attack.initial_access
    - attack.t1566.001
    - attack.execution
    - attack.t1204.002
---
title: The Gentlemen Ransomware - Go Binary Suspicious Execution
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
description: Detects potential execution of The Gentlemen ransomware based on Go binary characteristics and file encryption behavior.
status: experimental
date: 2026/06/01
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64234d239999
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '.exe'
    selection_go:
        Company: ''
        Description: ''
        Product|contains: 'Go'
    selection_behavior:
        CommandLine|contains:
            - 'encrypt'
            - 'crypto'
    condition: all of selection_*
falsepositives:
    - Legitimate Go applications (rare in enterprise endpoints)
level: critical
tags:
    - attack.impact
    - attack.t1486
---
title: BTMOB C2 Infrastructure - Network Connection
id: 9f8e7d6c-5b4a-3c2d-1e0f-9a8b7c6d5e4f
description: Detects outbound connections to known BTMOB RAT C2 infrastructure.
status: experimental
date: 2026/06/01
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/64234d230000
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|contains:
            - '191.96.225.241'
            - '191.96.79.41'
            - '191.96.79.133'
            - '191.96.224.87'
    condition: selection
falsepositives:
    - Unknown
level: high
tags:
    - attack.c2
    - attack.t1071.001


kql
// Hunt for SideCopy C2 Domain and XenoRAT indicators
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "abimj.edu.af" or RemoteIP == "103.132.98.224"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP

// Hunt for The Gentlemen and BTMOB File Hashes
DeviceFileEvents
| where Timestamp > ago(30d)
| where SHA256 in (
    "3b4194bdfe40d94031a94b30397ffd8a4b09d0a4057668e897b8bdcd1703dd01",
    "99127c8c67d90e2776beeb85281f9c68399bf4567b07a6b638d68b760212e88d",
    "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67",
    "fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68"
    )
| project Timestamp, DeviceName, FolderPath, SHA256, InitiatingProcessAccountName


powershell
# IOC Hunt Script for Windows Endpoints
# Scans for specific XenoRAT and The Gentlemen file hashes

$TargetHashes = @(
    "3b4194bdfe40d94031a94b30397ffd8a4b09d0a4057668e897b8bdcd1703dd01",
    "99127c8c67d90e2776beeb85281f9c68399bf4567b07a6b638d68b760212e88d",
    "22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67",
    "7a262d4cbbc4808932b6af42c4041f06",
    "25e3c200de4868d754a3b4f4f09ec2bf"
)

$SearchPaths = @("C:\", "D:\", "E:\") # Adjust as needed
$FoundThreats = @()

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        Write-Host "Scanning $Path for malicious hashes..."
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $Hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $Hash) {
                $FoundThreats += [PSCustomObject]@{
                    File = $_.FullName
                    Hash = $Hash
                    Status = "Detected"
                }
            }
            # Fallback to MD5 check for specific indicators
            $HashMD5 = (Get-FileHash -Path $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            if ($TargetHashes -contains $HashMD5) {
                $FoundThreats += [PSCustomObject]@{
                    File = $_.FullName
                    Hash = $HashMD5
                    Status = "Detected"
                }
            }
        }
    }
}

if ($FoundThreats) {
    Write-Host "THREAT DETECTED:" -ForegroundColor Red
    $FoundThreats | Format-Table -AutoSize
} else {
    Write-Host "No matching files found." -ForegroundColor Green
}