Detection Rules — Multi-Cluster Open-Directory 79.137.192.3 (Rhadamanthys MaaS / BellaMain PhaaS / Inkognito)

Campaign: OpenDirectory-MultiCluster-Rhadamanthys-BellaMain-Inkognito-79.137.192.3 Date: 2026-05-15 Author: The Hunters Ledger License: CC BY 4.0 Reference: https://the-hunters-ledger.com/reports/opendirectory-79-137-192-3-20260515/

Detection Coverage Summary

Three operationally-separate clusters shared the multi-tenant Aeza bulletproof IP 79.137.192.3: a Rhadamanthys MaaS-customer loader/Stage-2 (Cluster C), a BellaMain Turkish phishing-as-a-service panel (Cluster A), and the Inkognito VPN/phishing brand portfolio (Cluster B). A Tofsee spam-botnet build is documented separately as an unrelated co-tenant. This package has been re-tiered: rules that keyed solely on a hard-coded IP, domain, hash, or one-off filename with no surviving behavioral or structural signal once the literal is removed have been routed to the IOC feed rather than kept as standalone rules.

Detection vs Hunting: Detection rules are high-fidelity and evasion-resilient, safe to alert on. Hunting rules are broader, for scoping and threat-hunting. Expect to review the hits.

Highest-confidence anchors:

• The .frontb PE section name + Roland decoy string, and the operator-modified Q3VM bytecode magic 0x14744214 + Roland (both YARA Detection) are family-wide Rhadamanthys structural indicators. They are expected to generalize beyond this one MaaS customer.
• The HKU\<SID>\Software\SibCode\sn registry marker (Sigma Hunting) is confirmed across four independent sibling Stage-2 sandbox runs, not just this customer’s sample; it covers pre-0.9.1 builds only.
• The BellaMain panel’s bespoke admin-directory and function-name strings (YARA Detection) and admin-endpoint request paths (Sigma Detection), and the Rhadamanthys customer panel-ID URL token e6d92c6b5b2a03bee7fbab40 (Suricata Detection), survive infrastructure rotation. Each keys on an operator/developer artifact, not the current IP or domain.

Atomics routed to the IOC feed: six of the original package’s rules keyed solely on a hard-coded IP, a domain list, or a hash/imphash/PDB-path combination, with no behavior surviving once the literal is removed. The Rhadamanthys C2 IP 79.133.180.168:3394 (a direct TCP match and a second rule using it as a hardcoded TLS SNI content match), the BellaMain staging IP 79.137.192.3 (HTTP Host match), the 17-domain Inkognito brand-portfolio list (a Sigma dns selection and a Suricata PCRE with no content prefilter), and the Tofsee co-tenant’s SHA256/imphash/PDB-path fingerprint. All values are carried in opendirectory-79-137-192-3-20260515-iocs.json; three domains referenced only in the original rules (akredup.ru, divar-irantop.shop, catnpv.xyz) were not yet in the feed and have been added.

Multi-Family Organization

This detection package targets three operationally-separate operators that shared the multi-tenant Aeza bulletproof IP 79.137.192.3. Cross-cluster linkage is LOW. Co-residency on this IP is NOT operationally diagnostic. Detections are organized by cluster so defenders can apply only the rules relevant to their environment:

YARA Rules

Detection Rules

Rhadamanthys .frontb Stage-2 Section Marker

Tier: Detection Robustness: 3 ATT&CK Coverage: T1027 (Obfuscated Files or Information), T1140 (Deobfuscate/Decode Files or Information) Confidence: HIGH Rationale: The .frontb PE section name is a family-wide Rhadamanthys Stage-2 characteristic (a pre-allocated empty runtime buffer for the decrypted payload), not specific to this one MaaS customer — it is expected to recur across other customers’ Stage-2 builds. Paired with the Roland decoy string from the Stage-2 plaintext, also part of the family’s shared anti-analysis tradecraft. False Positives: None known — .frontb is not a standard MSVC/MinGW/Delphi/Go section name, and the co-required Roland decoy string has no legitimate-software collision. Blind Spots: A future Rhadamanthys build variant that renames the .frontb section would evade; the rule targets the on-disk Stage-2 payload, not a memory-only unpack state that discards section headers. Validation: Scan the reference Stage-2 sample — both the section name and the Roland string must match; a legitimate PE with an unrelated empty data section must NOT fire (the Roland co-condition prevents that). Deployment: Endpoint AV/EDR file scan, static triage of extracted/decrypted Stage-2 payloads.

/*
   Yara Rule Set
   Identifier: Multi-Cluster Open-Directory 79.137.192.3 (Rhadamanthys MaaS / BellaMain PhaaS / Inkognito)
   Author: The Hunters Ledger
   Source: https://the-hunters-ledger.com/
   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/
*/

import "pe"

rule MALW_Rhadamanthys_FrontbSection
{
    meta:
        description = "Detects Rhadamanthys Stage-2 binaries by the family-stable .frontb PE section name (a pre-allocated empty runtime buffer for the decrypted Stage-2 payload). Anchored with a Roland decoy string from the Stage-2 plaintext to reduce false positives."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "804f45487c1cda5b69c743f9eb691a12fe0fdcf0d3a9f32003898f1e3836af50"
        family = "Rhadamanthys"
        cluster = "C"
        threat_class = "infostealer,maas"
        id = "b64f32bc-0c99-582b-b1a0-8c3c569ef6d4"

    strings:
        $s_roland = "Roland" ascii wide

    condition:
        uint16(0) == 0x5A4D
        and filesize < 2MB
        and for any i in (0 .. pe.number_of_sections - 1) : (
            pe.sections[i].name == ".frontb"
        )
        and $s_roland
}

Rhadamanthys Operator-Modified Q3VM Bytecode Magic

Tier: Detection Robustness: 3 ATT&CK Coverage: T1027.013 (Encrypted/Encoded File) Confidence: HIGH Rationale: The operator-modified Q3VM derivative bytecode magic (0x14744214, vs. stock Q3VM 0x12721444) characterizes this Rhadamanthys build lineage generally, not a per-customer artifact — unlike the customer-specific cipher-material rules below, this is expected to catch other MaaS customers running the same Stage-2 version. Paired with the family-wide Roland decoy string. False Positives: None known — the modified magic value does not occur outside a Rhadamanthys Stage-2 build of this lineage. Blind Spots: A future Rhadamanthys build that changes the modified-magic value (or reverts to stock Q3VM) would evade. Validation: Scan the reference Stage-2 sample — the 4-byte magic and the Roland string must both match; a file embedding only stock Q3VM (0x12721444) must NOT fire. Deployment: Endpoint AV/EDR file scan, scanning of a saved dump of the unpacked Stage-2. Live process-memory scanning does not match: the condition’s filesize test is undefined there, so only files and saved dumps are scanned.

rule MALW_Rhadamanthys_Q3VMBytecodeModifiedMagic
{
    meta:
        description = "Detects Rhadamanthys Stage-2 binaries containing the operator-modified Q3VM derivative bytecode magic 0x14744214 (vs stock Q3VM 0x12721444). Anchored with a Roland decoy string co-condition because a 4-byte magic alone has unacceptable false-positive risk."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "804f45487c1cda5b69c743f9eb691a12fe0fdcf0d3a9f32003898f1e3836af50"
        family = "Rhadamanthys"
        cluster = "C"
        threat_class = "infostealer,maas,vm_obfuscation"
        id = "b069b1e8-a290-58e7-b2be-12743835ba77"

    strings:
        $b_magic_le = { 14 42 74 14 }
        $s_roland = "Roland" ascii wide

    condition:
        uint16(0) == 0x5A4D
        and filesize < 2MB
        and $b_magic_le
        and $s_roland
}

Rhadamanthys Operator Loader Build/Campaign Strings

Tier: Detection Robustness: 2 ATT&CK Coverage: T1027 (Obfuscated Files or Information) Confidence: HIGH Rationale: Requires 2-of-4 operator-specific strings: two build/campaign ID literals, a 45-character operator credential/token, and the customer panel ID also used in the Suricata URI-path rule below. The panel ID was independently observed stable across two beacons roughly 40 days apart, giving this combination real cross-time durability evidence beyond a single sample. False Positives: None known — all four strings are operator-chosen values with no legitimate-software collision; the 2-of-4 threshold means an operator must rotate at least three of the four to evade, since any two remaining strings still match. Blind Spots: A loader rebuild must rotate at least three of the four strings to evade (any two remaining strings still satisfy 2 of them); the rule does not generalize to other MaaS customers (these are this operator’s own values). Validation: Scan the reference loader sample — at least 2 of the 4 strings must match; unrelated software must NOT fire. Deployment: Endpoint AV/EDR file scan, static triage of loader binaries.

rule MALW_Rhadamanthys_OperatorLoaderStrings
{
    meta:
        description = "Detects this Rhadamanthys customer's Stage-1 loader by operator-specific build/campaign ID strings observed in std::cout output and operator credential strings. Requires 2-of-N matches to reduce false positives on any single string appearing in unrelated content."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "5c38a5dd3703b1c4b8c2466b18ce9f4c45ef4c9bf6c3096bee8b24d20ecd247a"
        family = "Rhadamanthys"
        cluster = "C"
        threat_class = "loader,operator_specific"
        id = "76476cd6-5dc9-5c43-ae9b-22fc6f92ba0c"

    strings:
        $s_id1 = "BombAUb23456" ascii fullword
        $s_id2 = "DubzAias932" ascii fullword
        $s_cred = "Ahuh783bhASbsxAsiopJQAiwhhbchG&*#U897u*#&*473" ascii
        $s_panel_id = "e6d92c6b5b2a03bee7fbab40" ascii fullword

    condition:
        uint16(0) == 0x5A4D
        and filesize < 5MB
        and 2 of them
}

BellaMain PhaaS Panel Source Strings (Admin Directory, Wadanz Functions, Alias)

Tier: Detection Robustness: 2 ATT&CK Coverage: None ATT&CK Note: The rule is a static string match on panel files and observes no technique. The report maps the kit’s Telegram Bot API exfiltration to T1102 and its phishing pages to T1566.002; those are behaviours of the kit, not events this rule tests. Confidence: HIGH Rationale: Requires the obfuscated admin-directory name, or the Wadanz developer’s session-encryption function names, or the operator alias combined with a secondary anchor. The Wadanz function names are a developer-signature artifact — durable across panel redeployments and potentially useful for pivoting to other panels by the same developer. False Positives: None known — the admin directory string and Wadanz function names have no legitimate-software collision. The rule has no PHP marker or file-extension test, so any file under 500 KB that holds one of those strings matches, including a threat-report or analysis note that quotes them. Blind Spots: A future BellaMain build from a different developer (no Wadanz function names, different admin directory) would evade. Validation: Scan the BellaMain panel archive/PHP source — the admin dir string or Wadanz function names must match; unrelated PHP source must NOT fire. Deployment: Web-server file-integrity scanning, hosting-provider abuse triage, static triage of seized panel archives.

rule MALW_BellaMain_PHPPanel
{
    meta:
        description = "Detects files under 500 KB holding BellaMain Turkish PhaaS panel strings (the panel source is PHP, but the rule has no PHP marker or extension test): the Wadanz developer pseudonym function names (sifreleWadanz / sifrecozWadanz session encryption helpers) and the obfuscated admin directory name. Operator alias @AresRS34 alone is NOT sufficient to trigger — it's paired with a BellaMain-specific anchor to prevent false positives on threat intelligence reports about this actor."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "f791fae41cdd3f141221d1783ed4779c839de7fc834ff4fc80a5d7f74b11ff88"
        family = "BellaMain"
        cluster = "A"
        threat_class = "phaas,panel"
        id = "1f58eaf6-b4d6-5e5d-b4a2-f481987b0684"

    strings:
        $s_admindir = "V5VgjLU0jsDe" ascii
        $s_aliasaresrs = "@AresRS34" ascii
        $s_wadanz_enc = "sifreleWadanz" ascii
        $s_wadanz_dec = "sifrecozWadanz" ascii
        $s_dbname = "jakartaxdw" ascii

    condition:
        filesize < 500KB
        and (
            $s_admindir
            or any of ($s_wadanz_enc, $s_wadanz_dec)
            or ($s_aliasaresrs and any of ($s_wadanz_enc, $s_wadanz_dec, $s_dbname))
        )
}

Hunting Rules

Rhadamanthys Stage-2 Import Combination (USER32, ADVAPI32 and GDI32 Imports, No WS2_32 or CRYPT32)

Tier: Hunting Robustness: 2 ATT&CK Coverage: None ATT&CK Note: An import-table test observes no technique. The report maps the Stage-2 packing and decode behaviour to T1027.002 and T1140; the rule tests neither. Confidence: MODERATE Rationale: The rule requires six named imports (three from USER32, one from ADVAPI32, two from GDI32) and the absence of any WS2_32 or CRYPT32 import. It does not count imports or limit the import table to those six, so a binary with many other imports also matches. That combination is a structural pattern for this Stage-2 build, but — as flagged in the original analysis — a minimal-import-surface signal alone can match unrelated GDI-heavy applications. Intended as a corroborating signal alongside the other Rhadamanthys rules in this file, not a standalone alert. False Positives: Unrelated GDI-heavy applications with a similarly minimal import table could coincidentally match; not intended for standalone alerting. Deployment: Endpoint AV/EDR file scan as a secondary/corroborating signal only — pair with another Rhadamanthys Detection-tier rule before treating a hit as high-confidence.

import "pe"

rule MALW_Rhadamanthys_Stage2_ImportSurface
{
    meta:
        description = "Detects Rhadamanthys Stage-2 binaries by an import combination: USER32 GetDC/ReleaseDC/GetSystemMetrics + ADVAPI32 RegQueryValueExW combined with two GDI32 imports (Ellipse and GetAspectRatioFilterEx), and no WS2_32 or CRYPT32 import. The rule does not cap the total number of imports. Stage-2 payloads avoid common crypto/network library imports — the absence of WS2_32 and CRYPT32 raises specificity."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "804f45487c1cda5b69c743f9eb691a12fe0fdcf0d3a9f32003898f1e3836af50"
        family = "Rhadamanthys"
        cluster = "C"
        threat_class = "infostealer,maas"
        fp_risk = "MEDIUM — minimal-import surface alone could match unrelated GDI-heavy applications; pair with other Rhadamanthys rules for high-confidence verdict."
        id = "65d56771-90a6-5465-9bfd-8b247839e1e6"

    condition:
        uint16(0) == 0x5A4D
        and filesize < 2MB
        and pe.imports("USER32.dll", "GetDC")
        and pe.imports("USER32.dll", "ReleaseDC")
        and pe.imports("USER32.dll", "GetSystemMetrics")
        and pe.imports("ADVAPI32.dll", "RegQueryValueExW")
        and pe.imports("GDI32.dll", "Ellipse")
        and pe.imports("GDI32.dll", "GetAspectRatioFilterEx")
        and not pe.imports("WS2_32.dll")
        and not pe.imports("CRYPT32.dll")
}

Rhadamanthys Customer-Specific Stage-2 CBC-XOR IV

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1027 (Obfuscated Files or Information), T1140 (Deobfuscate/Decode Files or Information) Confidence: MODERATE Rationale: A single 16-byte cryptographic IV embedded at a fixed offset in this customer’s Stage-2. The byte pattern itself has negligible collision risk with unrelated software, but durability across future rebuilds by this same customer is inferred, not confirmed by a second observed sample — a single-anchor rule keyed on one build’s embedded constant is brittle by definition, even when the constant itself is highly specific. False Positives: None known on the byte pattern itself. Deployment: Static triage / pivot-hunting for this specific MaaS customer’s Stage-2 builds; not for standalone alerting given the single-sample-only confirmation of this constant.

rule MALW_Rhadamanthys_CustomerCBCXOR_IV
{
    meta:
        description = "Detects this specific Rhadamanthys MaaS customer's Stage-2 binaries by the customer-specific 16-byte CBC-XOR IV embedded in .rdata at offset 0x0001c434. Different MaaS customers use different IVs — this is the highest-value per-customer fingerprint in the package, though its stability across this customer's future rebuilds is inferred rather than confirmed by a second sample."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "804f45487c1cda5b69c743f9eb691a12fe0fdcf0d3a9f32003898f1e3836af50"
        family = "Rhadamanthys"
        cluster = "C"
        threat_class = "infostealer,maas,customer_specific"
        id = "769462d4-efd8-52a6-8e6c-de4357bbbb21"

    strings:
        $b_iv = { f6 35 8d 79 df 69 c5 77 d9 dc e6 bb 77 fa 4f a7 }

    condition:
        uint16(0) == 0x5A4D
        and filesize < 2MB
        and $b_iv
}

Rhadamanthys Customer-Specific Loader RC4 Key

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1140 (Deobfuscate/Decode Files or Information), T1027.002 (Software Packing) Confidence: MODERATE Rationale: Same brittleness profile as the CBC-XOR IV rule above — a single 31-byte RC4 key embedded at a fixed offset in this customer’s loader, used to decrypt the embedded Stage-2 PE. Near-zero collision risk on the byte pattern, but cross-rebuild stability is unconfirmed from a single sample. False Positives: None known on the byte pattern itself. Deployment: Static triage / pivot-hunting for this specific MaaS customer’s loader builds; not for standalone alerting.

rule MALW_Rhadamanthys_LoaderRC4Key
{
    meta:
        description = "Detects this specific Rhadamanthys customer's Stage-1 loader by the 31-byte RC4 key embedded at &DAT_00433820, used to decrypt the embedded Stage-2 PE at &DAT_00436a70. This is the loader-side counterpart to MALW_Rhadamanthys_CustomerCBCXOR_IV (which anchors on the Stage-2); cross-rebuild stability of this key is inferred rather than confirmed."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-15"
        hash1 = "5c38a5dd3703b1c4b8c2466b18ce9f4c45ef4c9bf6c3096bee8b24d20ecd247a"
        family = "Rhadamanthys"
        cluster = "C"
        threat_class = "loader,customer_specific"
        id = "acb71818-6c54-56e7-a401-bd0151e8e4ff"

    strings:
        $b_rc4_key = { e0 80 25 40 d0 2d 0f ea eb 27 7d c7 20 e3 90 b0 6d fd 64 d8 f8 10 4d 95 81 e7 88 e5 12 71 5b }

    condition:
        uint16(0) == 0x5A4D
        and filesize < 5MB
        and $b_rc4_key
}

Tofsee 2023 Build Static Tradecraft (Co-Tenant Reference)

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1027.001 (Binary Padding) ATT&CK Note: The condition tests PE shape (section sizes, the WinHTTP import shape, three injection API names), eight rare API names and four English words. Service creation (T1543.003), mail protocols (T1071.003), external proxy (T1090.002), sandbox evasion (T1497) and indicator removal (T1027.005) are what the investigation draft records for the Tofsee family; no string in this rule tests them, so they are not claimed. Confidence: MODERATE Rationale: Tofsee is an unrelated spam-botnet family that co-tenants 79.137.192.3; it is not part of the Rhadamanthys/BellaMain/Inkognito campaign investigated here, retained as an analyst reference. The rule is explicitly family-bound (not campaign-bound): a broad structural + behavioral combination (import shape in which WinHttpWriteData is imported while WinHttpOpen, WinHttpConnect and WinHttpOpenRequest are not, injection API triad, rare-API bucket, and two of four short English words standing in for the build’s word-salad version metadata) intended for hunting sweeps against this 2023 Tofsee build lineage, not for blocking actions. Wording fix 2026-10-11: the description and this sentence used to say the rule triggers on word-salad version metadata; the condition counts the strings Hole, Bill, Fire and Selfie (ASCII or UTF-16) anywhere in the file and never reads the version resource (no pe.version_info test), so those words in code, data or an unrelated resource satisfy it. The draft this rule was lifted from says the word-salad strings are build-specific and can vary. False Positives: Some legitimate heavily-packed or obfuscated software with similarly unusual import shapes could coincidentally match individual clauses; the word clause is weak (two common four- to six-letter English words anywhere in a PE), so the narrowing comes from the import-shape, section-size, injection-API and rare-API clauses together. The full combination is narrow but not goodware-validated to zero FP. Deployment: Endpoint AV/EDR file scan; hunting sweep for this specific Tofsee build lineage.

import "pe"

rule Tofsee_Bloater_2023_StaticTradecraft
{
    meta:
        description = "Detects Tofsee-family droppers exhibiting the 2023 build's anti-AV bloat + dynamic-API-resolution tradecraft. Triggers on PE-structure anomalies (virtual .data more than 100 times its raw size, `WinHttpWriteData` imported while `WinHttpOpen`, `WinHttpConnect` and `WinHttpOpenRequest` are all absent from the imports (other WinHTTP imports are not excluded)), the injection API triad, five of eight rare API names, and two of four short English words (Hole, Bill, Fire, Selfie) found anywhere in the file; the word test is not restricted to the version resource. Family-bound, not campaign-bound. Co-tenant on 79.137.192.3 — operationally separate from BellaMain/Inkognito/Rhadamanthys clusters."
        license = "CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/"
        author = "The Hunters Ledger"
        reference = "https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/"
        date = "2026-05-08"
        hash1 = "2910a52e0934c8f1cf247cf88d1fce010f2e52dfb1cf2f64ebf3dc53df4ef865"
        family = "Tofsee"
        cluster = "Co-tenant (separate from Clusters A/B/C)"
        threat_class = "spam_botnet,downloader,injector"
        id = "6dec01d5-e225-52b6-b3a1-c28325a70e99"

    strings:
        $winhttp_only_writedata = "WinHttpWriteData" ascii

        $rare_api_1 = "GetConsoleAliasA" ascii
        $rare_api_2 = "GetConsoleAliasExesLengthW" ascii
        $rare_api_3 = "FindFirstVolumeMountPointA" ascii
        $rare_api_4 = "GetNumaHighestNodeNumber" ascii
        $rare_api_5 = "DeleteTimerQueueTimer" ascii
        $rare_api_6 = "GlobalFindAtomA" ascii
        $rare_api_7 = "SetCalendarInfoA" ascii
        $rare_api_8 = "CreateHardLinkW" ascii

        $inject_1 = "VirtualAllocEx" ascii
        $inject_2 = "WriteProcessMemory" ascii
        $inject_3 = "GetThreadContext" ascii

        $wordsalad_meta_marker_1 = "Hole" ascii wide
        $wordsalad_meta_marker_2 = "Bill" ascii wide
        $wordsalad_meta_marker_3 = "Fire" ascii wide
        $wordsalad_meta_marker_4 = "Selfie" ascii wide

    condition:
        uint16(0) == 0x5A4D
        and pe.is_pe
        and pe.machine == pe.MACHINE_I386
        and pe.subsystem == pe.SUBSYSTEM_WINDOWS_GUI
        and pe.number_of_sections >= 4
        and $winhttp_only_writedata
        and pe.imports("WINHTTP.dll", "WinHttpWriteData")
        and not pe.imports("WINHTTP.dll", "WinHttpOpen")
        and not pe.imports("WINHTTP.dll", "WinHttpConnect")
        and not pe.imports("WINHTTP.dll", "WinHttpOpenRequest")
        and for any i in (0 .. pe.number_of_sections - 1) : (
            pe.sections[i].name == ".data" and
            pe.sections[i].virtual_size > pe.sections[i].raw_data_size * 100
        )
        and all of ($inject_*)
        and 5 of ($rare_api_*)
        and 2 of ($wordsalad_meta_marker_*)
}

Sigma Rules

Detection Rules

BellaMain PhaaS Panel HTTP Request Patterns

Tier: Detection Robustness: 2 ATT&CK Coverage: T1071.001 (Web Protocols) Confidence: HIGH Rationale: Corrected from the original: the rule’s condition OR’d a durable URI-path selector against a pure IP/domain host-match branch (cs-host|contains: 79.137.192.3 or cryptone.bot). Per the tiering rubric, a hard-coded IP/domain branch with no behavioral qualifier is an IOC-feed entry, not rule logic — both values are already in the feed. The host-match branch has been removed; the surviving rule is the bespoke BellaMain PHP admin-endpoint path list, which is host-independent and survives the panel being redeployed on new infrastructure. False Positives: Unlikely — the BellaMain panel PHP entry-point paths are bespoke and unlikely to collide with legitimate proxy/web traffic. Blind Spots: A future BellaMain build that renames its PHP entry points would evade; does not cover the panel if deployed with a different URL structure. Validation: Trigger a request to one of the listed BellaMain PHP paths — must match; unrelated proxy traffic must NOT fire. Deployment: Web/proxy log monitoring, egress-proxy alerting.

title: BellaMain PhaaS Panel HTTP Request Patterns
id: c7d4f0e1-5fab-6c1d-be4f-4e7fab0c1d23
status: experimental
description: >-
  Detects HTTP requests to BellaMain panel administrative endpoints. The panel exposes a small fixed
  set of PHP entry points (signin.php, dashboard.php, post.php, manager.php, cookie.php) that should
  not appear on legitimate web traffic from internal endpoints. This selector is host-independent and
  survives the panel being redeployed on new infrastructure. Pair with the IOC feed's blocklist for
  79.137.192.3 and cryptone.bot for additional coverage of this specific deployment.
references:
    - https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/
author: The Hunters Ledger
date: 2026-05-15
tags:
    - attack.command-and-control
    - attack.t1071.001
    - detection.emerging-threats
    - stp.3
logsource:
    category: proxy
detection:
    selection_uri:
        cs-uri-stem|contains:
            - '/BellaMain/signin.php'
            - '/BellaMain/dashboard.php'
            - '/BellaMain/database/post.php'
            - '/BellaMain/manager.php'
            - '/BellaMain/database/cookie.php'
    condition: selection_uri
falsepositives:
    - >-
      Unlikely — the BellaMain panel PHP entry-point paths are bespoke and unlikely to
      collide with legitimate proxy/web traffic.
level: high

Hunting Rules

InstallUtil.exe Spawned by a Process in a User-Writable Path (Rhadamanthys Hollowing Precursor)

Tier: Hunting Robustness: 2 ATT&CK Coverage: T1218.004 (InstallUtil) ATT&CK Note: The report maps the loader’s EAX-redirect hollowing to T1055.012; this rule sees only the creation of the host process and not the hollowing, so that technique is not tagged. The report’s own table writes InstallUtil as T1218.008, which ATT&CK v19.2 defines as Odbcconf; InstallUtil is T1218.004. Confidence: MODERATE Rationale: The LOLBin-abuse pattern (InstallUtil.exe spawned from a user-writable parent path) survives recompiles because it describes how the loader launches, not a malware-specific string, which gives Robustness 2. It carries no family-specific test and tests no hollowing, memory or thread-context behaviour, and the only exclusions are msiexec, devenv and MSBuild, so installers and updaters that run from AppData or ProgramData and call InstallUtil are not excluded. For that reason it is a Hunting lead (level medium) and is not alert-grade; it was Detection, Robustness 3, level high before the 2026-10-11 review. False Positives: Legitimate developer or installer workflows that invoke InstallUtil.exe from temp directories, and installers or updaters that run from AppData\Roaming, Users\Public or ProgramData and use InstallUtil (none of the latter observed in this corpus). Blind Spots: A future build that hollows a different LOLBin, or launches InstallUtil.exe from a parent path not in the suspicious-path list, would evade. The rule tests only the creation of the InstallUtil.exe process, so it cannot tell a hollowed instance from a benign one. Validation: Trigger the loader’s launch of InstallUtil.exe — the child-process creation must match (only the creation is tested, not the hollowing); msiexec/devenv/MSBuild-spawned InstallUtil.exe must NOT fire. Deployment: Endpoint EDR / Sysmon-fed SIEM (process-creation telemetry).

title: InstallUtil.exe Spawned by a Process in a User-Writable Path (Rhadamanthys Hollowing Precursor)
id: b5e2f3d9-4e8c-5a0b-ad3f-3d6f8a9b0c12
status: experimental
description: >-
  Detects creation of an InstallUtil.exe process from the .NET Framework directory whose parent runs from
  AppData\Local\Temp, AppData\Roaming, Users\Public or ProgramData, unless the parent is msiexec, devenv
  or MSBuild. This Rhadamanthys customer's loader creates InstallUtil.exe suspended and then hollows it
  with an EAX-redirect (W^X memory transitions, entry point set in EAX); the hollowing happens after
  process creation and this rule does not observe it, so a match is the precursor only. Installers and
  developer tooling that run from those paths can spawn InstallUtil.exe too. Pair with network telemetry
  for InstallUtil.exe outbound connections for a higher-confidence verdict.
references:
    - https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/
author: The Hunters Ledger
date: 2026-05-15
tags:
    - attack.stealth
    - attack.t1218.004
    - detection.emerging-threats
    - stp.3
logsource:
    product: windows
    category: process_creation
detection:
    selection_image:
        Image|endswith: '\InstallUtil.exe'
        Image|contains: '\Microsoft.NET\Framework'
    selection_parent_suspicious:
        ParentImage|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\Users\Public\'
            - '\ProgramData\'
    filter_legit_parent:
        ParentImage|endswith:
            - '\msiexec.exe'
            - '\devenv.exe'
            - '\MSBuild.exe'
    condition: selection_image and selection_parent_suspicious and not filter_legit_parent
falsepositives:
    - >-
      Legitimate developer or installer workflows that invoke InstallUtil.exe from temp
      directories, and installers or updaters that run from the listed paths.
level: medium

Rhadamanthys SibCode Software Registry Key Marker

Tier: Hunting Robustness: 1 ATT&CK Coverage: T1112 (Modify Registry) Confidence: HIGH Rationale: Confirmed across four independent sibling Stage-2 sandbox runs (this sample plus three others), not a single-sample artifact: a family-wide execution marker with no known benign collision. Tier fix 2026-10-11 (round 2): it is one registry value name that the developer removed in v0.9.1, so it identifies the older lineage only and a rename costs the operator nothing; Robustness 1, Hunting, level medium (it was Detection, Robustness 3). Boundary fix 2026-10-11 (round 2): the key-path test was contains, so SibCode\snBackup matched too; the Sysmon TargetObject for a value write ends with the value name, so the test is now endswith. Logic fix 2026-10-11: the description names HKU\<SID>\Software\SibCode\sn (the per-user hive, which is how the report records the write), but the selection was the key-path substring alone, so a machine-wide HKLM\SOFTWARE\SibCode\sn write matched as well; the rule now also requires the HKU\ prefix Sysmon renders for a per-user key. Tags verified against the current ATT&CK technique-tactic data via sigma check: T1112 (Modify Registry) requires its attack.persistence and/or attack.defense-impairment tactic tag(s) present; both are carried below, matching the original tagging. False Positives: None known — the SibCode\sn key path has no documented benign software using it. Blind Spots: A future build that writes this marker under a different registry path would evade. The report ties the marker to pre-v0.9.1 builds (the developer removed it in v0.9.1 per the cited Check Point changelog), so newer builds do not write it and the rule covers the older lineage only. This is a footprint/marker, not a blocking control on its own. Validation: Trigger execution of a Rhadamanthys Stage-2 sample — the registry write must match; unrelated software’s registry activity must NOT fire. Deployment: Endpoint EDR / Sysmon-fed SIEM (registry telemetry).

title: Rhadamanthys SibCode Software Registry Key Marker
id: a4f1e2c8-3d7b-4f9a-9c2e-2c5e7f8d9a01
status: experimental
description: >-
  Detects creation or modification of HKU\<SID>\Software\SibCode\sn registry value, a family-stable
  Rhadamanthys execution marker observed across multiple sibling Stage-2 sandbox runs (Dapato dropper
  variants e827d13c, 457aecd8, bc9fe5e9). Per-instance value is a license/build timestamp from the MaaS
  panel. No known benign software writes this key.
references:
    - https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/
author: The Hunters Ledger
date: 2026-05-15
tags:
    - attack.persistence
    - attack.defense-impairment
    - attack.t1112
    - detection.emerging-threats
logsource:
    product: windows
    category: registry_set
detection:
    selection_key:
        TargetObject|endswith: '\Software\SibCode\sn'
    selection_hive:
        TargetObject|startswith: 'HKU\'
    condition: selection_key and selection_hive
falsepositives:
    - >-
      Unlikely. The SibCode\sn key path has no documented benign software using it.
level: medium

Suricata Signatures

Detection Rules

Rhadamanthys Customer Panel-ID URL Pattern

Tier: Detection Robustness: 2 ATT&CK Coverage: T1071.001 (Web Protocols) Confidence: HIGH Rationale: The 24-hex-character customer panel ID in the beacon URL path was observed stable across two beacons roughly 40 days apart (2026-04-03 and 2026-05-13) — real cross-time evidence of durability, and it survives the C2 moving to new IP/domain infrastructure since it keys on a URL path token, not a host match. This is the strongest network-layer fleet-enumeration pivot in the package. False Positives: None known — a 24-hex-character path token matching this exact value has negligible collision risk with unrelated HTTP traffic. Blind Spots: Evaded if the operator’s MaaS panel rotates the panel ID; misses non-HTTP or differently-structured beacon URL schemes (an alternate URL prefix was observed in one sibling sample). Validation: Replay a PCAP of a Rhadamanthys beacon carrying this panel ID in the URI — must alert; unrelated HTTP traffic must NOT. Deployment: Network IDS/IPS at perimeter and internal segmentation points.

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"THL DETECT OpenDirectory-79.137.192.3 Rhadamanthys MaaS-Customer Panel ID URL Pattern (C2 Transport Indicator)"; flow:established,to_server; http.uri; content:"/e6d92c6b5b2a03bee7fbab40/"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/; classtype:trojan-activity; sid:9300203; rev:3; metadata:author The_Hunters_Ledger, date 2026-05-15;)

JARM detection note: JARM fingerprint 2ad2ad0002ad2ad00042d42d00000007e6e35b6c9fce6eec13762f8506fe09 (current 79.133.180.168:3394 Samsung-cert period) and 2ad2ad0002ad2ad00042d42d00000000f78d2dc0ce6e5bbc5b8149a4872356 (79.137.192.3 Apache-on-Win64 stack) are useful for broader Rhadamanthys-customer C2 fingerprinting and BellaMain-style staging server identification respectively. JARM matching is best implemented at the network-monitoring layer (Zeek, Arkime, custom JARM scanners) rather than as a Suricata rule.

Coverage Gaps

The following areas were considered for detection coverage but excluded. Defenders should be aware of what is NOT covered:

1. Anti-VM and anti-debug primitives in Stage-2. Rhadamanthys Stage-2 implements timing-based anti-analysis (14-second sleep with denormal-sentinel checks), analyzer-process blocklist, and 0xCC anti-forensic memory scrubbing. These primitives are not converted to detection rules because they generate false positives on legitimate security tools (debuggers, EDR sensors, sandbox helpers) that exhibit similar behaviors.

2. Rhadamanthys plugin module fingerprints. The Stage-2 supports modular plugins (XS1/XS2 browser/wallet/MFA harvesters) loaded dynamically. The plugin module binaries themselves were not extracted from this customer’s infrastructure. Detection coverage of plugin-specific behaviors requires plugin samples.

3. Per-victim build randomization. Rhadamanthys MaaS rebuilds Stage-1 loaders per-customer with rotating obfuscation (junk byte insertions, opcode reordering). Bytecode-pattern-based detection of the loader is therefore brittle. The rules above anchor on operator-specific strings and customer-specific cipher material, which are stable across rebuilds for the SAME customer but will not catch other customers.

4. The inner Q3VM bytecode programs. Each Q3VM bytecode entry inside Stage-2 implements a distinct stealing primitive (browser, wallet, etc.). Bytecode-level detection is not portable, customer rebuilds rotate the operator-permuted opcode table. The MALW_Rhadamanthys_Q3VMBytecodeModifiedMagic rule above catches the magic + operator anchor, which is stable; the bytecode programs themselves are not covered.

5. Aeza ASN-wide blocking. AS216246 / AS204603 / AS210644 (Aeza Group) host both malicious tenants (BellaMain, Inkognito) and legitimate Russian-language services. ASN-level blocking is too broad for most defenders. Coverage is provided at the IP and domain level instead.

6. CryptOne fake exchange detection. The cryptone.bot domain is Cloudflare-fronted and the origin IP is hidden. DNS query detection is provided via the IOC feed but the exchange page itself appears legitimate to most fraud-detection heuristics, defenders relying on URL reputation feeds may not see this domain flagged for some time.

7. Stage-1 pre-execution detection. This customer’s loader uses MSVC2019 + standard libraries with no obvious packer signature. Pre-execution AV detection relies on cloud-side hash matching once the file has been seen and submitted. The YARA rules above are best deployed as file scans of extracted or dumped payloads and in post-extraction hunting, not as pre-execution AV signatures. Each Rhadamanthys rule tests filesize, which is undefined in a live process-memory scan, so a memory image has to be saved to a file before these rules can match it.

8. Atomics routed to the IOC feed (6 of the original package’s 18 rules). The Rhadamanthys C2 IP 79.133.180.168:3394 (a direct TCP match and a second rule using it as a hardcoded TLS SNI content match), the BellaMain staging IP 79.137.192.3 (an HTTP Host match), the 17-domain Inkognito brand-portfolio list (a Sigma dns selection and a Suricata PCRE with no content prefilter), and the Tofsee co-tenant’s SHA256/imphash/PDB-path combination all keyed solely on a hard-coded literal with no behavior surviving its removal, per the tiering rubric’s routing test, these are IOC-feed entries, not rules. All values are in opendirectory-79-137-192-3-20260515-iocs.json; three domains (akredup.ru, divar-irantop.shop, catnpv.xyz) were referenced only in the original rules and have been added to the feed’s domain list.

9. Cluster B (Inkognito) has no surviving standalone rule. Every original rule scoped to Cluster B, the Sigma DNS-query selection and the Suricata PCRE, was a pure domain-list match with no corroborating behavioral or structural qualifier. Unlike Clusters A and C, no bespoke code artifact, panel-side string, or protocol-level signature was captured for the Inkognito brand portfolio (VPN/phishing/CryptOne) in the underlying analysis. Coverage for this cluster is therefore IOC-feed-only (17 domains, BLOCK action). What would enable a rule: a captured artifact from the Inkognito operator’s own infrastructure, a distinctive backend API response shape, a shared JS/config fingerprint (the index-CoeWw2zM.js frontend bundle hash is already in the feed as a file-hash IOC but was not analyzed for a portable code-level YARA signature), or a consistent non-domain-dependent URL/header pattern.

10. Rhadamanthys customer-specific cipher material (CBC-XOR IV, RC4 key) tiered as Hunting, not Detection. Both are single-anchor byte-pattern matches with near-zero false-positive risk, but each was observed in exactly one sample from this customer, cross-rebuild stability is asserted in the original analysis but not confirmed by a second observed build carrying the same constant. They are retained as Hunting-tier pivot/triage rules rather than Detection-tier alerts. What would raise confidence: a second sample from the same MaaS customer (a different panel-ID beacon or a later-dated build) carrying the identical IV or RC4 key.

License

Detection rules are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).
Free to use, including commercially, with attribution to The Hunters Ledger.

@misc{hunters-ledger-opendirectory-79-137-192-3-20260515-detections,
  author       = {Harrison, Joseph},
  title        = {Detection Rules — Multi-Cluster Open-Directory 79.137.192.3 (Rhadamanthys MaaS / BellaMain PhaaS / Inkognito)},
  howpublished = {The Hunter's Ledger},
  year         = {2026},
  month        = {may},
  url          = {https://the-hunters-ledger.com/hunting-detections/opendirectory-79-137-192-3-20260515-detections/},
  note         = {Published 15 May 2026. Licensed CC BY 4.0.}
}