Threat Summary
The five pulses describe one converging criminal economy rather than isolated activity: credential, session, cookie, wallet, and device-control theft is being industrialized across Windows, Android, identity SaaS, and cryptocurrency workflows. The Windows cluster links Zer0day Stealer, an HVNC remote-control tool, and ENIGMA Locker through a leftover Rust build path under /home/tcherber/.cargo/, a strong operator-development artifact that ties stealer, RAT, and ransomware staging to the same build environment. The Android cluster shows StreamRat using Meta and TikTok ads, fake TV-streaming lures, accessibility abuse, MediaProjection, VNC-style takeover, and MaaS adjacency to Mirax, GodFather, and Sturnus against Spanish finance users. The identity cluster is the most urgent for enterprises: Knight Office uses DocuSign lures, Monday.com redirects, compromised Joomla sites, AiTM capture of Microsoft 365 session tokens, OAuth abuse, device registration, and Windows Hello for Business manipulation to defeat password-only controls and some MFA flows. Larva-24009/HeptaX continues LNK phishing against healthcare and enterprise users with QuasarRAT, UltraVNC, Notifier, Nirsoft tooling, keylogging, and obfuscated PowerShell. The Exodus campaign shows supply-chain-style trust abuse: fake PDFs or software updates deliver JavaScript, then a tampered MSI installs real Exodus 24.33.4 with modified components and modular Dll4_cmd, Dll4_fileman, Dll4_browser, Dll4_socks, Dll4_vnc, and Dll4_script payloads using Azure Table Storage as resilient infrastructure. Objectives are consistent: steal credentials and tokens, persist quietly, proxy or remote-control the victim, monetize finance and crypto access, and enable ransomware or business-email compromise follow-on.
Threat Actor / Malware Profile
Zer0day Stealer is Rust-based and cross-platform, stealing cryptocurrency wallets, browser credentials, Office documents, and VPN configurations. Its association with HVNC and ENIGMA Locker through the .cargo build path suggests a developer or small crew moving from theft to hands-on-keyboard control and encryption. Expect AMSI evasion, packed Rust binaries, user-profile staging, and exfiltration to fixed infrastructure such as 93.152.223.30. StreamRat is an Android banking trojan delivered by malvertising and social ads. It uses a two-stage dropper, internet-blocking behavior during install to frustrate inspection, then requests accessibility and screen-capture capabilities to observe banking apps, inject overlays, stream the device, and perform full device takeover. Larva-24009/HeptaX uses Korean and global lures such as hospital surveys, blockchain, project proposals, and resumes. Malicious LNK files launch obfuscated PowerShell that installs backdoors, QuasarRAT or UltraVNC remote access, Notifier components, Nirsoft credential utilities, and keyloggers. Knight Office is not classic password phishing: it is an AiTM kit that proxies the real Microsoft 365 login, harvests session cookies, drives a console for token replay, and may register devices or abuse OAuth and Windows Hello for Business to convert a phish into durable access. The tampered Exodus installer preserves trust by installing the genuine wallet while adding modified files and DLL modules for command execution, file management, browser theft, SOCKS proxying, VNC, and scripting. C2 blends dedicated IPs and domains with legitimate cloud services, including Azure Table Storage, which makes simple domain blocking insufficient without behavior analytics.
IOC Analysis
The indicator set is weighted toward file hashes, with supporting IPv4, domain, and URL-like redirect infrastructure. Hashes such as d222549235db4112333d82e12f767d47, 178f890f62db90738b11300dd272537240b1c8a599d2ebeccdea01654811fed0, ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3, and the Exodus Dll4 module hashes are best used for retro-hunts in EDR, email detonation, proxy download logs, and software inventory rather than as durable blocks, because repacking is trivial. Network IOCs are more operationally useful in the short term: block and alert on 93.152.223.30, 45.147.28.59, pozeny.shop, aonexa.shop, mainsec.site, us05.org, and the Knight Office .vu domains including kleepxrnlinecorporation.vu, advancedplacyncement.vu, amstardmzsmc.vu, arandasoftzfdware.vu, avisoretentiunionllc.vu, capitalflwxinancialpartners.vu, certififiycationedge.vu, and connectivnqzityltd.vu. Treat .vu corporate-impersonation names as high-confidence malicious when seen near authentication, document-signing, or redirect flows. SOC teams should normalize indicators into STIX/TAXII or MISP, push hashes to EDR and email sandbox blocklists, push IPs/domains to firewall, DNS sinkhole, secure web gateway, and MDM, and add the domains to Microsoft Defender for Endpoint network protection and Conditional Access named-location exclusions. For decoding and pivoting, use CyberChef for PowerShell and JavaScript deobfuscation, VirusTotal/OTX pivots for hash reputation, urlscan.io for redirect chains, Shodan/Censys for IP history, Passive DNS for .vu infrastructure, Microsoft Graph sign-in logs for token replay, and APK analysis tools such as MobSF, jadx, and Frida for StreamRat droppers.
Detection Engineering
---
title: Larva HeptaX LNK to Obfuscated PowerShell Backdoor
id: 9f0a1f2d-otx-2026-0902-001
status: experimental
description: Detects document-themed LNK phishing chains that launch hidden or encoded PowerShell consistent with Larva-24009/HeptaX delivery of QuasarRAT, UltraVNC, Notifier, keyloggers, and Nirsoft credential tools.
author: Security Arsenal
date: 2026/09/02
references:
- https://asec.ahnlab.com/en/94786/
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- 'explorer.exe'
- 'outlook.exe'
- 'winword.exe'
- 'excel.exe'
- 'msedge.exe'
- 'chrome.exe'
selection_child:
Image|endswith:
- 'powershell.exe'
- 'pwsh.exe'
- 'wscript.exe'
- 'cscript.exe'
- 'mshta.exe'
- 'rundll32.exe'
selection_cli:
CommandLine|contains:
- '.lnk'
- ' -enc'
- ' -encodedcommand'
- ' -nop'
- ' -w hidden'
- 'downloadstring'
- 'invoke-expression'
- 'iex'
- 'frombase64string'
- 'pozeny.shop'
- 'aonexa.shop'
- 'mainsec.site'
- 'ultravnc'
- 'quasar'
condition: selection_parent and selection_child and selection_cli
falsepositives:
- Admin automation that legitimately launches hidden PowerShell from shortcuts
level: high
tags:
- attack.initial_access
- attack.t1566.001
- attack.t1059.001
- attack.t1204.002
---
title: OTX Credential Theft DNS and AiTM Infrastructure
id: 9f0a1f2d-otx-2026-0902-002
status: experimental
description: Detects DNS queries to OTX-listed credential theft, AiTM phishing, modular RAT, and Android banker infrastructure including Knight Office .vu domains, Larva domains, us05.org, and fixed malware IPs resolved by endpoints.
author: Security Arsenal
date: 2026/09/02
logsource:
category: dns
product: windows
detection:
selection_query:
QueryName|contains:
- 'pozeny.shop'
- 'aonexa.shop'
- 'mainsec.site'
- 'us05.org'
- 'kleepxrnlinecorporation.vu'
- 'advancedplacyncement.vu'
- 'amstardmzsmc.vu'
- 'arandasoftzfdware.vu'
- 'avisoretentiunionllc.vu'
- 'capitalflwxinancialpartners.vu'
- 'certififiycationedge.vu'
- 'connectivnqzityltd.vu'
selection_vu_pattern:
QueryName|endswith: '.vu'
QueryName|contains:
- 'corporation'
- 'financial'
- 'soft'
- 'llc'
- 'cert'
- 'connect'
selection_answer:
answer|contains:
- '93.152.223.30'
- '45.147.28.59'
condition: selection_query or (selection_vu_pattern) or selection_answer
falsepositives:
- Rare legitimate Vanuatu ccTLD business domains; validate against business need and WHOIS age
level: critical
tags:
- attack.command_and_control
- attack.t1071.001
- attack.credential_access
- attack.t1557
- attack.t1552
---
title: Trojanized Exodus Installer Loads Modular Dll4 RAT Components
id: 9f0a1f2d-otx-2026-0902-003
status: experimental
description: Detects Windows hosts loading Dll4 command, file manager, browser theft, SOCKS, VNC, or script modules after execution of installer, JavaScript dropper, or Exodus wallet package tampering.
author: Security Arsenal
date: 2026/09/02
references:
- https://www.huntress.com/blog/exodus-crypto-wallet-installer-rat
logsource:
category: image_load
product: windows
detection:
selection_image:
ImageLoaded|contains:
- 'dll4_cmd'
- 'dll4_fileman'
- 'dll4_browser'
- 'dll4_socks'
- 'dll4_vnc'
- 'dll4_script'
selection_process:
Image|endswith:
- 'msiexec.exe'
- 'wscript.exe'
- 'cscript.exe'
- 'node.exe'
- 'exodus.exe'
- 'rundll32.exe'
CommandLine|contains:
- 'exodus'
- 'update'
- '24.33.4'
- '.msi'
- '.js'
- 'azure'
- 'table.core.windows.net'
- 'us05.org'
condition: selection_image and selection_process
falsepositives:
- None expected for Dll4 module naming outside the reported campaign
level: critical
tags:
- attack.execution
- attack.t1059
- attack.persistence
- attack.t1547
- attack.command_and_control
- attack.t1090
- attack.collection
- attack.t1056
let bad_ips = dynamic(['93.152.223.30','45.147.28.59']);
let bad_domains = dynamic(['pozeny.shop','aonexa.shop','mainsec.site','us05.org','kleepxrnlinecorporation.vu','advancedplacyncement.vu','amstardmzsmc.vu','arandasoftzfdware.vu','avisoretentiunionllc.vu','capitalflwxinancialpartners.vu','certififiycationedge.vu','connectivnqzityltd.vu']);
let bad_hashes = dynamic(['d222549235db4112333d82e12f767d47','12463a81a786b04fe4b3b7d1aa1222e589e5921d','178f890f62db90738b11300dd272537240b1c8a599d2ebeccdea01654811fed0','278762dfc0f743216a475919bdc9ecc59735bcc247bba5b7b468fc475407ec6a','6aef80514237808dfe25621a8912422d20a8414bc2054008a119e541166821b5','6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53','7cb59abaa268ac66461447773d46bb0b0e5e2568e35e1a8f1d07ac2ec57f67a6','ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3','e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c','10b40185106eb3760cb71c46117aa0bf','1500fefcdda275b70e2051a3e7d9f794','2973fda8d0d0fa0200a05889fce85df6','444fb3592cd1848660259a913684795b','4ad28d0313549e98383144d82982be6e','2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d','5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603','5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a','7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8','84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756','8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a','c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485']);
let net = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in (bad_ips) or RemoteUrl has_any (bad_domains) or RemoteUrl endswith '.vu'
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType;
let proc = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where MD5 in (bad_hashes) or SHA1 in (bad_hashes) or SHA256 in (bad_hashes)
or ProcessCommandLine has_any ('pozeny.shop','aonexa.shop','mainsec.site','us05.org','ultravnc','quasar','dll4_','exodus','24.33.4',' -enc','downloadstring','frombase64string')
or (FileName in~ ('powershell.exe','pwsh.exe','wscript.exe','cscript.exe','mshta.exe','msiexec.exe','rundll32.exe') and InitiatingProcessFileName in~ ('explorer.exe','outlook.exe','winword.exe','excel.exe','chrome.exe','msedge.exe'))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, MD5, SHA1, SHA256, FolderPath;
let loads = DeviceImageLoadEvents
| where TimeGenerated > ago(14d)
| where FileName startswith 'dll4_' or ImageLoaded has_any ('dll4_cmd','dll4_fileman','dll4_browser','dll4_socks','dll4_vnc','dll4_script')
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, FolderPath, SHA256;
union net, proc, loads
| sort by TimeGenerated desc
$ErrorActionPreference = 'SilentlyContinue'
$report = @()
$badIps = '93.152.223.30','45.147.28.59'
$badDomains = 'pozeny.shop','aonexa.shop','mainsec.site','us05.org','kleepxrnlinecorporation.vu','advancedplacyncement.vu','amstardmzsmc.vu','arandasoftzfdware.vu','avisoretentiunionllc.vu','capitalflwxinancialpartners.vu','certififiycationedge.vu','connectivnqzityltd.vu'
$badHashes = 'd222549235db4112333d82e12f767d47','12463a81a786b04fe4b3b7d1aa1222e589e5921d','178f890f62db90738b11300dd272537240b1c8a599d2ebeccdea01654811fed0','278762dfc0f743216a475919bdc9ecc59735bcc247bba5b7b468fc475407ec6a','6aef80514237808dfe25621a8912422d20a8414bc2054008a119e541166821b5','6bddf59e2a5065255cfc90d2e2e66e3bfd4a7cbf4e0b6341b4da93b574cc4f53','7cb59abaa268ac66461447773d46bb0b0e5e2568e35e1a8f1d07ac2ec57f67a6','ba83cc3c9535690191018edf73ca5c6001609df9919462796aa2e551f142e4d3','e0714788b4e2518b0d9d4cbf18c7217bb97718e01689d77338f1cc4a230fcb6c','10b40185106eb3760cb71c46117aa0bf','1500fefcdda275b70e2051a3e7d9f794','2973fda8d0d0fa0200a05889fce85df6','444fb3592cd1848660259a913684795b','4ad28d0313549e98383144d82982be6e','2f47cfbb13f7a8a2d30d287f4ddd974fabea6762ad9781d438eb53da41b4582d','5274e93e35586a341d14b50cdf8413d59c51fd94f32bdc70bfdfb77198367603','5fe753945da0eaac2c2ef3845cba603dea6c3e8529fa581d7e0192f8af60391a','7e74f6e2eb7a17a8d25bb322a14c392c9d92c6ab29fc66b50221da134a1bdba8','84437d4239d2a3d90c4faad0a3c0630b2f61a40f7bbd12109bef74d7613b8756','8c3b41ea5a85778145a6e5772bfee2eb0f8b027d0af199fb71a76dfb8bb29e5a','c513a7346484ee69a2931c4a89956ee50aa63e4366ef989315e669d8f10d7485'
$report += Get-NetTCPConnection | Where-Object { $badIps -contains $_.RemoteAddress } | Select-Object @{n='Type';e={'NetworkConnection'}},LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess
$report += Get-DnsClientCache | Where-Object { $name = $_.Entry; $badDomains | Where-Object { $name -like ('*' + $_ + '*') } } | Select-Object @{n='Type';e={'DnsCache'}},Entry,Name,Data
$runKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
foreach ($key in $runKeys) { Get-ItemProperty -Path $key | ForEach-Object { $_.PSObject.Properties | Where-Object { $_.Value -match 'powershell|wscript|cscript|mshta|rundll32|dll4_|exodus|pozeny|aonexa|mainsec|us05' } | Select-Object @{n='Type';e={'RunKey'}},@{n='Key';e={$key}},Name,@{n='Value';e={$_.Value}} } }
$report += Get-ScheduledTask | Where-Object { $_.TaskName -match 'exodus|update|notifier|ultravnc|quasar|dll4' -or ($_.Actions.Execute -match 'powershell|wscript|cscript|mshta|msiexec|node') } | Select-Object @{n='Type';e={'ScheduledTask'}},TaskName,TaskPath,State,@{n='Action';e={($_.Actions.Execute + ' ' + ($_.Actions.Arguments -join ' '))}}
$paths = 'C:\Users\Public','C:\ProgramData','C:\Windows\Temp',($env:TEMP),($env:APPDATA),($env:LOCALAPPDATA)
foreach ($p in $paths) { Get-ChildItem -Path $p -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'dll4_|exodus|zer0day|streamrat|notifier|ultravnc|quasar' -or $badHashes -contains $_.Name } | Select-Object @{n='Type';e={'SuspiciousFile'}},FullName,Length,LastWriteTime }
$report | Sort-Object Type | Format-List
Response Priorities
Immediate: block and sinkhole the listed IPs and domains, add hashes to EDR and email sandbox prevention, isolate hosts with Dll4 module loads, QuasarRAT/UltraVNC execution, or AiTM domain contact, disable suspicious Android devices in MDM, and preserve memory plus browser credential stores before cleanup. Within 24 hours: assume identity compromise for any host that touched Knight Office infrastructure; revoke all Microsoft 365 refresh tokens and sessions, require reauthentication with phishing-resistant MFA, review and remove malicious OAuth app consent, audit device registrations and Windows Hello for Business changes, rotate exposed browser, VPN, Office, wallet, and service credentials, and force password resets only after session revocation so stolen cookies do not survive. Within one week: harden the attack surface by blocking LNK and JS from email and web zones, enforcing Mark-of-the-Web detonation, enabling AMSI for Office and script hosts, using PowerShell Constrained Language Mode and Script Block Logging, restricting accessibility and screen-capture permissions on managed Android, blocking sideloaded APKs, adding Conditional Access token protection and continuous access evaluation, alerting on new device registration plus atypical travel or token replay, monitoring Azure Table Storage and cloud abuse as C2, and running brand monitoring for DocuSign, Exodus, streaming, banking, and M365 lures.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.