{
  "Event": {
    "uuid": "6b2ddd6b-2861-5626-b59e-9cf736ff2568",
    "info": "Dual-RAT Analysis: Pulsar RAT vs. NjRAT/XWorm",
    "date": "2025-12-20",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1791727767,
    "publish_timestamp": 1791727767,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"RAT\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Injection\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\".NET\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Cred Theft\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Scheduled Task - T1053.005\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Process Injection - T1055\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"File Deletion - T1070.004\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Web Protocols - T1071.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Non-Application Layer Protocol - T1095\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Dead Drop Resolver - T1102.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Video Capture - T1125\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Registry Run Keys / Startup Folder - T1547.001\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Shortcut Modification - T1547.009\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Encrypted Channel - T1573\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Power Settings - T1653\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "46298c22-d36c-5f35-b600-ac79d4860cbf",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791727767
      },
      {
        "uuid": "dc551367-973f-5cf4-9ee0-eefa17118dc8",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/dual-rat-analysis.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791727767
      },
      {
        "uuid": "86bc56d8-bb01-5227-ac86-b06c2c3016da",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/reports/dual-rat-analysis/",
        "to_ids": false,
        "comment": "Report, The Hunters Ledger",
        "timestamp": 1791727767
      },
      {
        "uuid": "2da39b8f-4b05-5272-939f-aded5f85f8bc",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/stix/dual-rat-analysis.json",
        "to_ids": false,
        "comment": "STIX 2.1 bundle, The Hunters Ledger",
        "timestamp": 1791727767
      },
      {
        "uuid": "c67028a1-6a8c-5097-99d5-83548d95f345",
        "type": "snort",
        "category": "Network activity",
        "value": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT Dual-RAT-Quasar-NjRAT HTTP User-Agent Containing iPhone OS 11_4_1 (Value Reported in NjRAT-XWorm Traffic, Not Family-Specific)\"; flow:established,to_server; http.user_agent; content:\"iPhone OS 11_4_1 like Mac OS X\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/; classtype:trojan-activity; sid:2100004; rev:4; metadata:author The_Hunters_Ledger, date 2025-12-06;)",
        "to_ids": false,
        "comment": "HTTP User-Agent Containing iPhone OS 11_4_1 (Value Reported in NjRAT/XWorm Traffic) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1071.001 | rule hash 83038c32 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "16e0b479-f1a2-5782-898a-e11579cca960",
        "type": "snort",
        "category": "Network activity",
        "value": "alert tcp $HOME_NET any -> $EXTERNAL_NET 4782 (msg:\"THL HUNT Dual-RAT-Quasar-NjRAT Outbound TCP Payload to Port 4782 (Quasar Default Port, Port-Only Lead)\"; flow:established,to_server; dsize:>0; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/; classtype:trojan-activity; sid:2100001; rev:4; metadata:author The_Hunters_Ledger, date 2025-12-06;)",
        "to_ids": false,
        "comment": "Outbound TCP Payload to Port 4782 (Quasar Default Port, Port-Only Lead) | TIER: Hunting | robustness 1 | confidence MODERATE | ATT&CK T1095 | rule hash 33cf50b2 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "e533c722-8bb6-57bb-a584-c70aed97cd33",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: NjRAT/XWorm Pastebin Dead-Drop C2 Resolution\nid: fa059bb8-a203-4528-a3ae-2b4f67b74576\nstatus: experimental\ndescription: >-\n  Detects a process named conhost.exe (the NjRAT/XWorm sample's\n  installed persistence name in this campaign) making an outbound\n  HTTPS connection to pastebin.com to resolve its dead-drop C2\n  endpoint. The legitimate Windows conhost.exe process does not\n  originate outbound network connections, so this name+destination\n  combination is a strong anomaly. Corrected from the original rule,\n  which also matched the literal filename \"server (1).exe\" - an\n  artifact of this analysis's own download/deduplication naming, not a\n  name the malware itself uses, and dropped here as non-durable.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.command-and-control\n    - attack.t1102.001\n    - attack.t1071.001\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        Image|endswith: '\\conhost.exe'\n        DestinationPort: 443\n        DestinationHostname|contains: 'pastebin.com'\n        Initiated: 'true'\n    condition: selection\nfalsepositives:\n    - >-\n      Unlikely; the legitimate Windows conhost.exe process does not\n      make outbound network connections in normal operation\nlevel: high",
        "to_ids": true,
        "comment": "NjRAT/XWorm Pastebin Dead-Drop C2 Resolution | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1102.001, T1071.001 | rule hash 7ba77ee5 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "09030721-129b-5f73-820d-708d731c8f9d",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: NjRAT/XWorm Persistence - Scheduled Task (Conhost, 1-Minute Interval)\nid: e0192277-e076-4aca-b960-ace5c5bb47ee\nname: njrat_persist_schtask\nstatus: experimental\ndescription: >-\n  Detects creation of a scheduled task named \"conhost\" running on a\n  1-minute recurring interval via schtasks.exe, the first of three\n  redundant persistence mechanisms established by the NjRAT/XWorm\n  variant analyzed in this campaign. Evaluated together with the\n  paired registry Run-key and startup-folder base rules via the\n  correlation rule below.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.t1053.005\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains|all:\n            - '/tn \"conhost\"'\n            - '/sc minute'\n            - '/mo 1'\n    condition: selection\nfalsepositives:\n    - >-\n      Legitimate administrative scripts or monitoring tools that\n      create a scheduled task literally named \"conhost\" on a\n      1-minute interval (unusual but not impossible)\nlevel: medium\n---\ntitle: NjRAT/XWorm Persistence - Registry Run Key (Conhost)\nid: e365a47c-836f-455d-bfc3-0cc3153d4aff\nname: njrat_persist_runkey\nstatus: experimental\ndescription: >-\n  Detects a registry Run key write referencing conhost.exe, the second\n  of three redundant persistence mechanisms established by the\n  NjRAT/XWorm variant analyzed in this campaign.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1547.001\n    - detection.emerging-threats\nlogsource:\n    category: registry_set\n    product: windows\ndetection:\n    selection:\n        TargetObject|contains: '\\Software\\Microsoft\\Windows\\CurrentVersion\\Run'\n        Details|contains: 'conhost.exe'\n    condition: selection\nfalsepositives:\n    - >-\n      Diagnostic or asset-management tooling that documents or\n      whitelists conhost.exe by name in a monitored Run-key context\nlevel: medium\n---\ntitle: NjRAT/XWorm Persistence - Startup Folder Shortcut (Conhost.lnk)\nid: 6b9f2cbd-895e-4f43-99f9-336ec1643b4a\nname: njrat_persist_startup\nstatus: experimental\ndescription: >-\n  Detects creation of a Startup-folder shortcut named conhost.lnk, the\n  third of three redundant persistence mechanisms established by the\n  NjRAT/XWorm variant analyzed in this campaign.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.persistence\n    - attack.privilege-escalation\n    - attack.t1547.009\n    - detection.emerging-threats\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection:\n        TargetFilename|endswith: '\\Startup\\conhost.lnk'\n    condition: selection\nfalsepositives:\n    - >-\n      Unlikely; a legitimate shortcut named exactly conhost.lnk in the\n      Startup folder has not been observed\nlevel: medium\n---\ntitle: NjRAT/XWorm Triple-Redundant Persistence - All-Three Correlation\nid: ca1fba48-5756-40d7-ab90-9fad61dd00b8\nstatus: experimental\ndescription: >-\n  Raises confidence to Detection-grade when all three NjRAT/XWorm\n  persistence base rules (scheduled task, registry Run key,\n  startup-folder shortcut - all referencing the conhost artifact\n  name) fire on the same host within a 10-minute window, consistent\n  with the triple-redundant persistence routine documented for this\n  campaign. A Sigma temporal correlation requires every listed rule\n  to match, so a variant that sets up only two of the three\n  mechanisms does not trigger it.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\nmodified: '2026-10-11'\ncorrelation:\n    type: temporal\n    rules:\n        - njrat_persist_schtask\n        - njrat_persist_runkey\n        - njrat_persist_startup\n    group-by:\n        - ComputerName\n    timespan: 10m\nfalsepositives:\n    - >-\n      Very unlikely; would require all 3 independently-implausible\n      conhost-named artifacts to appear on the same host within the\n      same 10-minute window for an unrelated reason\nlevel: high\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.t1053.005\n    - attack.t1547.001\n    - attack.t1547.009\n    - detection.emerging-threats",
        "to_ids": false,
        "comment": "NjRAT/XWorm Triple-Redundant Persistence: Base Rules + All-Three Correlation | TIER: Hunting | confidence HIGH for the correlation; MODERATE for each base rule individually. | ATT&CK T1053.005, T1547.001, T1547.009 | rule hash 433ac414 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "7570b070-b715-520d-940d-d356957e8601",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Quasar RAT C2 Connection on TCP 4782\nid: 6e5cd22d-2176-4069-85e6-0fe1075ebf2c\nstatus: experimental\ndescription: >-\n  Detects Client.exe, the Quasar RAT sample analyzed in this campaign,\n  establishing an outbound connection on TCP port 4782 - this build's\n  custom-encrypted C2 channel. Corrected from the original rule, which\n  required the specific C2 IP 185.208.159.182 as an AND condition; that\n  atomic is carried in the IOC feed for blocking, while this rule keeps\n  only the durable Image+port combination so it still fires if the\n  operator rotates C2 infrastructure.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.command-and-control\n    - attack.t1071.001\n    - attack.t1573\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        Image|endswith: '\\Client.exe'\n        DestinationPort: 4782\n        Initiated: 'true'\n    condition: selection\nfalsepositives:\n    - >-\n      Legitimate applications coincidentally named Client.exe using\n      TCP port 4782\nlevel: high",
        "to_ids": true,
        "comment": "Quasar RAT C2 Connection on TCP 4782 | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1071.001, T1573 | rule hash 1b27d815 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "1af61ca2-16c8-5f24-bc81-cebf7505c274",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Quasar RAT Mark of the Web Removal\nid: 469751f1-91ad-4b17-8c14-491a019f1f44\nstatus: experimental\ndescription: Detects Zone.Identifier alternate data stream deletion by Client.exe, the Quasar RAT sample analyzed in this campaign, characteristic of Mark-of-the-Web suppression to avoid re-triggering SmartScreen on subsequent executions\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.stealth\n    - attack.t1070.004\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    product: windows\n    category: file_delete\ndetection:\n    selection:\n        TargetFilename|contains: ':Zone.Identifier'\n        Image|endswith: '\\Client.exe'\n    condition: selection\nfalsepositives:\n    - Legitimate file management tools coincidentally named Client.exe\nlevel: high",
        "to_ids": true,
        "comment": "Quasar RAT Mark of the Web Removal | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1070.004 | rule hash c54f1997 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "bbb39c5c-027c-5df4-b0aa-df7c7f1142c2",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Quasar RAT Remote Thread Creation Into System Processes\nid: 6e1ad431-a53d-49ab-b6b0-0f6fb647d3a1\nstatus: experimental\ndescription: >-\n  Detects Client.exe (the Quasar RAT sample analyzed in this campaign)\n  creating a remote thread in explorer.exe, svchost.exe, or dllhost.exe\n  for process-injection-based defense evasion. Corrected from the\n  original rule, which selected on the process_creation category with\n  a CommandLine \"inject\" filter - a combination that does not\n  correspond to how thread-injection APIs actually generate telemetry;\n  re-anchored on the create_remote_thread category (Sysmon Event ID 8),\n  which is what genuinely captures this technique.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\nmodified: '2026-10-11'\ntags:\n    - attack.stealth\n    - attack.privilege-escalation\n    - attack.t1055\n    - detection.emerging-threats\n    - stp.2\nlogsource:\n    category: create_remote_thread\n    product: windows\ndetection:\n    selection:\n        SourceImage|endswith: '\\Client.exe'\n        TargetImage|endswith:\n            - '\\explorer.exe'\n            - '\\svchost.exe'\n            - '\\dllhost.exe'\n    condition: selection\nfalsepositives:\n    - >-\n      Legitimate software coincidentally named Client.exe that\n      legitimately injects into explorer.exe, svchost.exe, or\n      dllhost.exe (not observed, but architecturally possible)\nlevel: medium",
        "to_ids": false,
        "comment": "Quasar RAT Remote Thread Creation Into System Processes | TIER: Hunting | robustness 1 | confidence HIGH | ATT&CK T1055 | rule hash de98274a | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "c48a79c5-22ee-5403-9524-4762914fa71c",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Quasar RAT Scheduled Task Persistence via schtasks.exe\nid: 06347ef1-4a96-4d80-ba7b-d54d5148ced9\nstatus: experimental\ndescription: >-\n  Detects the Quasar RAT client's persistence-establishment routine -\n  a scheduled task named \"RuntimeBroker\" (masquerading as the\n  legitimate Windows process) created via schtasks.exe with an ONLOGON\n  trigger pointing at Client.exe. Corrected from the original rule,\n  which declared an invalid Security-log/EventID 106 combination with\n  a CommandLine field that log source does not carry; re-anchored on\n  the schtasks.exe process-creation event that actually contains this\n  command line.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\ntags:\n    - attack.persistence\n    - attack.execution\n    - attack.privilege-escalation\n    - attack.t1053.005\n    - detection.emerging-threats\n    - stp.3\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith: '\\schtasks.exe'\n        CommandLine|contains|all:\n            - '/tn \"RuntimeBroker\"'\n            - '/sc ONLOGON'\n            - 'Client.exe'\n    condition: selection\nfalsepositives:\n    - >-\n      Legitimate system administration scripts that create a scheduled\n      task literally named \"RuntimeBroker\" with an ONLOGON trigger\n      pointing at a file named Client.exe (unlikely combination)\nlevel: high",
        "to_ids": true,
        "comment": "Quasar RAT Scheduled Task Persistence via schtasks.exe | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1053.005 | rule hash 32fc9a33 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "3967fb45-771a-5dd8-aede-b4b7c33532bb",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Remote Thread Created by a Process Resident in AppData Roaming or Temp\nid: a1ea23fd-ff54-4115-bb49-89b7fa7b9cd4\nstatus: experimental\ndescription: >-\n  Detects a process running from a user's AppData Roaming or Local Temp\n  directory creating a remote thread in another process, a generic\n  process-injection step observed as part of the malware's\n  surveillance/persistence chain in this campaign. Two prior corrections\n  are folded in. The original rule declared a non-existent \"api_call\"\n  logsource category with a CallTrace field searched for the literal string\n  CreateRemoteThread; standard Windows telemetry does not expose API calls\n  that way, so it was re-anchored on the create_remote_thread category\n  (Sysmon Event ID 8). The selector was then narrowed from the whole\n  AppData tree to Roaming and Local Temp only, because AppData\\Local\\Programs\n  is the canonical per-user install root for a large population of ordinary\n  signed applications whose updaters legitimately inject remote threads;\n  matching all of AppData produced overwhelming false-positive volume in\n  any environment that allows per-user application installs.\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nauthor: The Hunters Ledger\ndate: '2025-12-06'\nmodified: '2026-07-30'\ntags:\n    - attack.stealth\n    - attack.privilege-escalation\n    - attack.t1055\n    - detection.emerging-threats\nlogsource:\n    category: create_remote_thread\n    product: windows\ndetection:\n    selection:\n        SourceImage|contains:\n            - '\\AppData\\Roaming\\'\n            - '\\AppData\\Local\\Temp\\'\n    condition: selection\nfalsepositives:\n    - >-\n      Legitimate AppData-installed software (auto-updaters, some\n      games, hardware-control utilities) that performs remote thread\n      injection for benign reasons\nlevel: medium",
        "to_ids": false,
        "comment": "Remote Thread Created by a Process Resident in AppData Roaming or Temp | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1055 | rule hash 91404055 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "8fc4d635-c23a-58f1-9799-2893d7a5cd4e",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Suspicious Access to Dead-Drop Services\nid: e5ef6bed-378b-4b30-8a72-2813bf37c310\nstatus: experimental\ndescription: Detects access to common dead-drop services that may indicate C2 infrastructure resolution\nauthor: The Hunters Ledger\ndate: '2025-12-06'\nreferences:\n    - https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\nlogsource:\n    product: windows\n    category: network_connection\ndetection:\n    selection:\n        DestinationHostname|contains:\n            - 'pastebin.com'\n            - 'githubusercontent.com'\n            - 'gist.githubusercontent.com'\n            - 'discordapp.com'\n            - 'discord.com'\n        Initiated: 'true'\n    filter_legitimate:\n        Image|endswith:\n            - '\\chrome.exe'\n            - '\\firefox.exe'\n            - '\\msedge.exe'\n            - '\\iexplore.exe'\n            - '\\teams.exe'\n            - '\\slack.exe'\n            - '\\discord.exe'\n    condition: selection and not filter_legitimate\nfalsepositives:\n    - Legitimate developer access to paste services\n    - Corporate tools using GitHub for configuration\nlevel: medium\ntags:\n    - attack.command-and-control\n    - attack.t1102.001\n    - detection.emerging-threats",
        "to_ids": false,
        "comment": "Suspicious Access to Dead-Drop Services from a Non-Browser Process | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1102.001 | rule hash 1f1a8b7b | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "13ff4d09-4aad-5eb3-8d2b-6a6e1ba2b21c",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: Dual-RAT Campaign - Quasar RAT and NjRAT/XWorm\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule NjRAT_XWorm_Triple_Persistence {\n   meta:\n      description = \"Detects the NjRAT/XWorm variant's triple-redundant persistence establishment routine via the simultaneous presence of its conhost-named scheduled task, registry Run key path, startup LNK filename, and 1-minute task frequency parameter\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\"\n      date = \"2025-12-06\"\n      hash1 = \"950aadba6993619858294599b3458d5d2221f10fe72b3db3e49883d496a705bb\"\n      hash2 = \"944d9e8d6f02375b31908ee05a0164fbb4804108\"\n      hash3 = \"28bf5a76144fbc4b5f7f02dfee4e2c17\"\n      family = \"NjRAT/XWorm\"\n      malware_type = \"RAT\"\n      campaign = \"Dual-RAT-185.208.159.182-Quasar-NjRAT\"\n      id = \"85fbe6d2-865b-5f69-81dd-f0db8bf50511\"\n   strings:\n      $task_name = \"conhost\" ascii wide\n      $task_freq = \"minute /mo 1\" ascii wide\n      $reg_key = \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\" ascii wide\n      $startup = \"Startup\\\\conhost.lnk\" ascii wide\n      $schtasks = \"schtasks /create\" ascii wide\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 150KB and\n      all of them\n}",
        "to_ids": true,
        "comment": "NjRAT/XWorm Triple-Redundant Persistence (Combined Static Signature) | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1053.005, T1547.001, T1547.009 | rule hash cadcc84e | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "d3fed060-2b59-5911-b112-5286e535fae1",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule NjRAT_XWorm_Core_Detection {\n   meta:\n      description = \"Detects the NjRAT/XWorm variant analyzed in this campaign via a required VB.NET runtime baseline combined with 3 or more of its distinctive builder config keys, dead-drop markers, or capability API names\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\"\n      date = \"2025-12-06\"\n      hash1 = \"950aadba6993619858294599b3458d5d2221f10fe72b3db3e49883d496a705bb\"\n      hash2 = \"944d9e8d6f02375b31908ee05a0164fbb4804108\"\n      hash3 = \"28bf5a76144fbc4b5f7f02dfee4e2c17\"\n      family = \"NjRAT/XWorm\"\n      malware_type = \"RAT\"\n      campaign = \"Dual-RAT-185.208.159.182-Quasar-NjRAT\"\n      id = \"86a672cb-1ac0-5927-aeee-b8c0a19ce9a7\"\n   strings:\n      $vb1 = \"Microsoft.VisualBasic\" ascii wide\n      $vb2 = \"System.Windows.Forms\" ascii wide\n\n      $cfg1 = \"Groub\" ascii fullword\n      $cfg2 = \"USBNM\" ascii fullword\n      $cfg3 = \"PasteUrl\" ascii fullword\n\n      $dd1 = \"pastebin.com\" ascii\n      $dd2 = \"iPhone Safari\" ascii wide\n\n      $per1 = \"minute /mo 1\" ascii wide\n      $per2 = \"Startup\\\\conhost.lnk\" ascii wide\n\n      $crit1 = \"RtlSetProcessIsCritical\" ascii fullword\n      $crit2 = \"BSOD\" ascii wide fullword\n\n      $slp1 = \"SetThreadExecutionState\" ascii fullword\n      $slp2 = \"ES_DISPLAY_REQUIRED\" ascii fullword\n      $slp3 = \"ES_SYSTEM_REQUIRED\" ascii fullword\n\n      $surv1 = \"capCreateCaptureWindowA\" ascii fullword\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 150KB and\n      all of ($vb*) and\n      3 of ($cfg1,$cfg2,$cfg3,$dd1,$dd2,$per1,$per2,$crit1,$crit2,$slp1,$slp2,$slp3,$surv1)\n}",
        "to_ids": false,
        "comment": "NjRAT/XWorm Capability Bucket (VB.NET Baseline + Distinctive Config/API Combination) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1125, T1653, T1102.001 | rule hash 3b317b91 | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "416833a1-3f06-5d88-86dc-a9f593eaf8c4",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule SUSP_PE_ZoneIdentifier_DeleteFile_Strings {\n   meta:\n      description = \"Detects a PE under 5 MB that carries both the :Zone.Identifier stream string and the DeleteFile API name, a static lead for Mark-of-the-Web removal capability. The rule has no Quasar-specific string, so any PE with both strings matches; the Quasar RAT sample that deletes this stream in the campaign is one of the files it would match. It reads strings only and does not observe a deletion\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/\"\n      date = \"2025-12-06\"\n      modified = \"2026-10-11\"\n      hash1 = \"2c4387ce18be279ea735ec4f0092698534921030aaa69949ae880e41a5c73766\"\n      hash2 = \"dc795961c8e63782fc0f53c08e7ca2e593df99fa\"\n      hash3 = \"b5491b58348600c2766f86a5af2b867f\"\n      family = \"Quasar RAT\"\n      malware_type = \"RAT\"\n      campaign = \"Dual-RAT-185.208.159.182-Quasar-NjRAT\"\n      id = \"a827b192-9f37-505a-a4c9-d32708430d6e\"\n   strings:\n      $zone_stream = \":Zone.Identifier\" ascii wide\n      $delete_api = \"DeleteFile\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize < 5MB and\n      all of them\n}",
        "to_ids": false,
        "comment": "Zone.Identifier and DeleteFile Strings in a PE (Mark-of-the-Web Removal Capability Lead) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1070.004 | rule hash cd2343aa | https://the-hunters-ledger.com/hunting-detections/dual-rat-analysis-detections/",
        "timestamp": 1791727767,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}