{ "type": "bundle", "id": "bundle--01f104cd-cd1c-4980-bce5-a23b2c549742", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.2958Z", "modified": "2026-10-01T19:54:20.2958Z", "name": "The Hunters Ledger", "identity_class": "organization" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--e476b5d2-7643-5710-bdca-4b1c3ac7359c", "value": "151.245.112.70" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3fee3b45-35a9-59d4-8549-5c770d1a7765", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.296353Z", "modified": "2026-10-01T19:54:20.296353Z", "name": "ipv4: 151.245.112.70", "description": "Shadow RAT C2 listener, extracted from AES-256 encrypted config in both ShadoClient.exe and ShadowClient.exe | XWorm C2 listener, extracted from Rijndael-256-ECB encrypted config in both XWormClient.exe and XWormClient2.exe | Shadow RAT cleartext port field, may be default/fallback or reconnection port, not confirmed active | Suspected ScreenConnect relay port (from Shodan InternetDB)", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '151.245.112.70']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--e1594e3f-2aab-56a6-9dc9-23c303b9bb73", "value": "185.11.145.145" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c3deb49e-aa27-5677-9370-c0e1c110835f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.299095Z", "modified": "2026-10-01T19:54:20.299095Z", "name": "ipv4: 185.11.145.145", "description": "Historical IP for epgoldsecurity.com, BlazingFast, AS47674, Netherlands. Active until 2026-03-26 migration", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '185.11.145.145']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 60 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--ec28d696-f1ad-51c0-8dc3-f13bbf365572", "value": "185.11.145.254" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--50b7f29d-dc44-5138-a447-6aa1bdb265a2", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.299541Z", "modified": "2026-10-01T19:54:20.299541Z", "name": "ipv4: 185.11.145.254", "description": "Secondary historical BlazingFast IP for epgoldsecurity.com, same ASN/provider", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '185.11.145.254']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 60 }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--1971ae28-6029-59b9-b00e-83184a7cc1ba", "value": "187.124.244.54" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eb340713-edd6-5722-a7dd-db563b8dc218", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.29991Z", "modified": "2026-10-01T19:54:20.29991Z", "name": "ipv4: 187.124.244.54", "description": "Current IP for epgoldsecurity.com, payload delivery server (Hostinger, AS47583)", "indicator_types": [ "malicious-activity" ], "pattern": "[ipv4-addr:value = '187.124.244.54']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--631f35e8-b883-5c2d-a89c-90ebea0e8efb", "value": "bluewiin.com" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--68d996c6-38c0-5cba-adb4-7ad15ef7e97f", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.300245Z", "modified": "2026-10-01T19:54:20.300245Z", "name": "domain: bluewiin.com", "description": "Brief single-day resolution to C2 IP (Jan 16, 2026). Likely testing or staging. Minimal passive DNS footprint.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'bluewiin.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 60, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 60 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--b7e1a70f-5ffa-5c3a-8132-56d4e653919e", "value": "breakingsecurity.online" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fc29e995-7600-566d-b2fc-e10928d0f688", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.300916Z", "modified": "2026-10-01T19:54:20.300916Z", "name": "domain: breakingsecurity.online", "description": "Resolved to C2 IP for ~3 days (Jan 13-16, 2026). Impersonates BreakingSecurity (Remcos RAT developer). The legitimate site is breakingsecurity.net.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'breakingsecurity.online']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--e38e6b03-407a-556b-b859-4305785e6108", "value": "epgoldsecurity.com" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--885d35bb-c36b-56a0-8c81-de2588cbe0e4", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.301383Z", "modified": "2026-10-01T19:54:20.301383Z", "name": "domain: epgoldsecurity.com", "description": "Payload delivery server hosting open directory where all 4 malware samples were found. Registered 2026-02-20 (Registrar.eu). Migrated BlazingFast to Hostinger on March 26. DomainTools risk: 100/100.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'epgoldsecurity.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--de523c66-8a81-5f9b-8603-eca98563c73b", "value": "harrismanlieb.ink" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--80946398-8430-566d-9101-be4e017231e5", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.301987Z", "modified": "2026-10-01T19:54:20.301987Z", "name": "domain: harrismanlieb.ink", "description": "Active primary domain on C2 IP 151.245.112.70. Registered 2026-02-12 (NameCheap). Self-hosted NS (ns2) pointing to C2 IP. DomainTools risk: 100/100. ScreenConnect deployed from March 1.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'harrismanlieb.ink']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "url", "spec_version": "2.1", "id": "url--3e8b7700-5ca6-5cc1-a06c-6c6583a80b04", "value": "http://ip-api.com/line/?fields=hosting" }, { "type": "domain-name", "spec_version": "2.1", "id": "domain-name--0ca16df1-cfaa-5df5-9349-cc8cc1b69daa", "value": "latssko.com" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7ad1cbf7-849a-5361-8566-b0fc424679bc", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.302455Z", "modified": "2026-10-01T19:54:20.302455Z", "name": "domain: latssko.com", "description": "Previous operational domain on C2 IP. Active 2026-01-16 to 2026-02-20 (~35 days). Self-hosted NS (ns2), wildcard DNS. Rotated out when harrismanlieb.ink came online.", "indicator_types": [ "malicious-activity" ], "pattern": "[domain-name:value = 'latssko.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2026-04-04T00:00:00Z", "confidence": 80, "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_opencti_detection": false, "x_opencti_score": 80 }, { "type": "file", "spec_version": "2.1", "id": "file--666e21cb-6b32-5fd4-91f8-7be4924b6e24", "hashes": { "SHA-256": "240e2575f20c75c6b5e2ea69bc0f0d9675ffd3fea315ca818bcbee2572ee972f" } }, { "type": "file", "spec_version": "2.1", "id": "file--eaea1821-815f-5c6e-9531-b48fed0535b7", "hashes": { "SHA-256": "291543374d0ee4f983132128dcef16ebc8c058f07b1dc1b1f7d7e11d189fd42a" } }, { "type": "file", "spec_version": "2.1", "id": "file--7c64059e-9250-55ab-8c5a-a2751cee4ab8", "hashes": { "SHA-256": "3a4b0f50ea3eac55e22cbf24d873f9a1632d8f71e1fba91178c539030626ab32" } }, { "type": "file", "spec_version": "2.1", "id": "file--a64cfaaa-7d2f-5cec-8c16-88e8af11e1ae", "hashes": { "SHA-256": "6682f3b4568807b0e57acbf2acd627e25be44304cac9241f2b51efa892aaab0c" } }, { "type": "file", "spec_version": "2.1", "id": "file--d86c9111-95fe-575d-9189-1de527523be0", "hashes": { "SHA-256": "b7fa1e5cefb7f5ad367271f29bde8558566c17da169b5dac797c79beb3fc4531" } }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6e3aefb2-f3b6-549f-b588-065452144f61", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T06:31:47.982679Z", "modified": "2026-10-11T06:31:47.982679Z", "name": "RAT_ShadowRAT_Client_Namespace_Version_Mutex", "indicator_types": [ "malicious-activity" ], "pattern": "/*\n Yara Rule Set\n Identifier: Shadow RAT v2.6.4.0 & XWorm 3.0-5.0 — OpenDirectory 151.245.112.70\n Author: The Hunters Ledger\n Source: https://the-hunters-ledger.com/\n License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule RAT_ShadowRAT_Client_Namespace_Version_Mutex {\n meta:\n description = \"Detects the Shadow RAT client by any one of three string combinations: three of the Shadow.Common.Messages, Shadow.Common.Cryptography, Shadow.Client.Steam and costura.shadow.common.dll.compressed strings; the 2.6.4.0 version constant with the single-instance mutex GUID; or the Shadow Client and Shadow Client Startup strings with one Shadow namespace string. Only the second branch tests the version, and no branch requires the Costura asset. Shadow RAT is a heavily modified Quasar RAT fork with HVNC, WinRE persistence, crypto clipper, and Kematian stealer integration.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n hash1 = \"3a4b0f50ea3eac55e22cbf24d873f9a1632d8f71e1fba91178c539030626ab32\"\n hash2 = \"ad4e81b84f3c6f8b30863f90e8a09631112b0f5b\"\n hash3 = \"f162419fce4eb4dff92be342c47662c2\"\n family = \"ShadowRAT\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"b5534e60-539d-5b22-bd1b-8fe7af7936d0\"\n strings:\n $s1 = \"Shadow.Common.Messages\" ascii wide\n $s2 = \"Shadow.Common.Cryptography\" ascii wide\n $s3 = \"Shadow.Client.Steam\" ascii wide\n $s4 = \"2.6.4.0\" ascii wide\n $s5 = \"4c7e33e6-3f73-4b4c-a411-89fe63cdfa1e\" ascii wide\n $s6 = \"costura.shadow.common.dll.compressed\" ascii wide nocase\n $s7 = \"Shadow Client\" ascii wide\n $s8 = \"Shadow Client Startup\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 5MB and\n (\n 3 of ($s1, $s2, $s3, $s6) or\n ($s4 and $s5) or\n ($s7 and $s8 and 1 of ($s1, $s2, $s3))\n )\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a96ee6be-d8c9-51a1-99a5-0dc3ee599c61", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.312332Z", "modified": "2026-10-11T07:42:16.01599Z", "name": "RAT_ShadowRAT_CommonDLL", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_ShadowRAT_CommonDLL {\n meta:\n description = \"Detects Shadow.Common.dll, the shared library component of Shadow RAT containing core message types, AES-256 crypto, and protobuf-net serialization. This DLL is embedded via Costura.Fody and extracted at runtime. Matches files and saved dumps.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n hash1 = \"6682f3b4568807b0e57acbf2acd627e25be44304cac9241f2b51efa892aaab0c\"\n hash2 = \"3ef537af9aad6edc6792d53e25124a1649e5f655\"\n hash3 = \"e4736090733ca81eeabdb16b4b8f9cc3\"\n family = \"ShadowRAT\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"1410182a-22e9-5c3e-a7f6-4506067f23f1\"\n strings:\n $s1 = \"Shadow.Common.Messages.Monitoring.HVNC\" ascii\n $s2 = \"Shadow.Common.Messages.FunStuff.GDI\" ascii\n $s3 = \"Shadow.Common.Messages.ClientManagement.WinRE\" ascii\n $s4 = \"Shadow.Common.DNS.HostsManager\" ascii\n $s5 = \"Shadow.Common.Cryptography.Aes256\" ascii\n condition:\n uint16(0) == 0x5A4D and\n filesize < 500KB and\n $s5 and 2 of ($s1, $s2, $s3, $s4)\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--30582b93-51ea-556c-a492-39b55de6cbba", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T06:31:47.983082Z", "modified": "2026-10-11T07:42:16.01611Z", "name": "RAT_ShadowRAT_AMSI_Patch_Or_Padded_Bypass_Strings", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_ShadowRAT_AMSI_Patch_Or_Padded_Bypass_Strings {\n meta:\n description = \"Detects the Shadow RAT AMSI and ETW bypass artifacts by any one of three branches: the 15-byte sequence the report records for the AmsiScanBuffer patch (the report annotates it as returning E_INVALIDARG 0x80070057, but read as x64 it ends in jmp rsp, so its function is not verified here), or the Replace(\\\"*\\\", \\\"\\\") deobfuscation string with the padded amsi.dll and AmsiScanBuffer fragments, or the same string with the report's padded EtwEventWrite and ntdll.dll literals (the report describes the ETW patch as a single RET over EtwEventWrite). Each branch fires on its own; the rule does not test the Shadow namespace or version and does not require the AMSI and ETW halves together.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n hash1 = \"3a4b0f50ea3eac55e22cbf24d873f9a1632d8f71e1fba91178c539030626ab32\"\n hash2 = \"ad4e81b84f3c6f8b30863f90e8a09631112b0f5b\"\n hash3 = \"f162419fce4eb4dff92be342c47662c2\"\n family = \"ShadowRAT\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"41b37a99-0a66-5368-823f-567390fca6a7\"\n strings:\n // 15-byte AMSI patch sequence as the report records it: mov eax,0x80070057; mov rax,[rsp]; add rsp,8; jmp rsp\n $b1 = { B8 57 00 07 80 48 8B 04 24 48 83 C4 08 FF E4 }\n // Asterisk-padding deobfuscation pattern\n $s1 = \".Replace(\\\"*\\\", \\\"\\\")\" ascii wide\n // Obfuscated amsi.dll string fragment\n $s2 = \"m*s*i\" ascii wide\n // Obfuscated AmsiScanBuffer string fragment\n $s3 = \"Buf*f*er\" ascii wide\n // Obfuscated EtwEventWrite literal, as the report records it\n $s4 = \"**E****t*wEv*e***n*******t**Wr*i*****t**e\" ascii wide\n // Obfuscated ntdll.dll literal, as the report records it\n $s5 = \"n***t**d***ll*.*d*****l*l\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 5MB and\n (\n $b1 or\n ($s1 and $s2 and $s3) or\n ($s1 and $s4 and $s5)\n )\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b62a9b40-db7a-51c8-9c12-6097c0b2f098", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.312521Z", "modified": "2026-10-01T19:54:20.312521Z", "name": "RAT_ShadowRAT_Crypto_Clipper", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_ShadowRAT_Crypto_Clipper {\n meta:\n description = \"Detects Shadow RAT crypto clipper module via clipboard monitoring method names paired with multi-currency address fields (BTC/LTC/ETH) in Shadow.Common.dll. Enables real-time substitution of victim cryptocurrency addresses during financial transactions.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n hash1 = \"6682f3b4568807b0e57acbf2acd627e25be44304cac9241f2b51efa892aaab0c\"\n hash2 = \"3ef537af9aad6edc6792d53e25124a1649e5f655\"\n hash3 = \"e4736090733ca81eeabdb16b4b8f9cc3\"\n family = \"ShadowRAT\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"bfad2681-f3ae-59ca-81ac-8bab2eabf913\"\n strings:\n $s1 = \"SetClipboardMonitoringEnabled\" ascii wide\n $s2 = \"SendClipboardData\" ascii wide\n $s3 = \"BitcoinAddress\" ascii wide\n $s4 = \"LitecoinAddress\" ascii wide\n $s5 = \"EthereumAddress\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 500KB and\n $s1 and $s2 and\n 2 of ($s3, $s4, $s5)\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3a21f2ea-92db-53e6-9cf1-01cff3fe67ad", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.312601Z", "modified": "2026-10-01T19:54:20.312601Z", "name": "RAT_ShadowRAT_WinRE_Persistence", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_ShadowRAT_WinRE_Persistence {\n meta:\n description = \"Detects Shadow RAT WinRE persistence module via command handler method names and namespace string in Shadow.Common.dll. WinRE persistence survives OS reinstallation and is an uncommon technique with limited EDR behavioral coverage — file-level detection is the primary viable layer.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n hash1 = \"6682f3b4568807b0e57acbf2acd627e25be44304cac9241f2b51efa892aaab0c\"\n hash2 = \"3ef537af9aad6edc6792d53e25124a1649e5f655\"\n hash3 = \"e4736090733ca81eeabdb16b4b8f9cc3\"\n family = \"ShadowRAT\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"fd61e389-8b85-5701-9449-0b9230e9157c\"\n strings:\n $s1 = \"DoAddWinREPersistence\" ascii wide\n $s2 = \"DoRemoveWinREPersistence\" ascii wide\n $s3 = \"Shadow.Common.Messages.ClientManagement.WinRE\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 500KB and\n ($s1 or $s2) and $s3\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b36b85a8-4a34-5620-a622-6e64c278fb0a", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.312678Z", "modified": "2026-10-01T19:54:20.312678Z", "name": "RAT_XWorm_30_50_Config", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_XWorm_30_50_Config {\n meta:\n description = \"Detects XWorm 3.0-5.0 builder output based on campaign-specific config AES keys, the group tag , ip-api.com hosting detection string, and triple persistence indicators. The config key strings double as process mutexes in XWorm's implementation.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n hash1 = \"b7fa1e5cefb7f5ad367271f29bde8558566c17da169b5dac797c79beb3fc4531\"\n hash2 = \"e69e32522835f37f18095e219385057b6bbdc959\"\n hash3 = \"7e2fe58934874e442cfa183a34ceb24c\"\n family = \"XWorm\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"763299ce-a94a-533d-b3bf-7bbd804769ae\"\n strings:\n // Campaign-specific config AES keys (also used as process mutexes)\n $s1 = \"PdqPY2fw6ffCVLQ8\" ascii wide\n $s2 = \"ZdoNsjYfT6begqDl\" ascii wide\n // Runtime C2 encryption key decrypted from config\n $s3 = \"Nothing2hide\" ascii wide\n // Builder group tag\n $s4 = \"\" ascii wide\n // Anti-analysis hosting check URL\n $s5 = \"ip-api.com/line/?fields=hosting\" ascii wide\n // Scheduled task persistence argument\n $s6 = \"/create /f /sc minute /mo 1\" ascii wide\n // USB spread filename\n $s7 = \"USB.exe\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 500KB and\n (\n (1 of ($s1, $s2) and ($s3 or $s4)) or\n ($s4 and $s5) or\n ($s5 and $s6 and $s7)\n )\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7f7af980-e0d7-5536-b5a8-eb288c4b9b04", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.312752Z", "modified": "2026-10-11T14:08:42.42321Z", "name": "RAT_XWorm_Rijndael256ECB_Crypto", "indicator_types": [ "malicious-activity" ], "pattern": "rule RAT_XWorm_Rijndael256ECB_Crypto {\n meta:\n description = \"Hunting rule for a PE file under 500 KB that holds the strings RijndaelManaged, ECB, MD5CryptoServiceProvider and FromBase64String together with two of Win32_ComputerSystem, SbieDll and IsAttached. The report documents XWorm's config encryption as Rijndael-256-ECB keyed from an MD5 hash copied into a 32-byte array at offsets 0 and 15 with one overlapping byte; this rule tests none of that construction, no block size, no XWorm-specific string and no version, so it matches any small program carrying those names.\"\n license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n author = \"The Hunters Ledger\"\n reference = \"https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\"\n date = \"2026-04-04\"\n modified = \"2026-10-11\"\n hash1 = \"b7fa1e5cefb7f5ad367271f29bde8558566c17da169b5dac797c79beb3fc4531\"\n hash2 = \"e69e32522835f37f18095e219385057b6bbdc959\"\n hash3 = \"7e2fe58934874e442cfa183a34ceb24c\"\n family = \"Generic-NET-Crypto-XWorm-Lead\"\n malware_type = \"RAT\"\n campaign = \"OpenDirectory-DualRAT-MaaS-151.245.112.70\"\n id = \"7c53be1a-c635-593f-9763-1e81230698ee\"\n strings:\n $s1 = \"RijndaelManaged\" ascii wide\n $s2 = \"ECB\" ascii wide\n $s3 = \"MD5CryptoServiceProvider\" ascii wide\n $s4 = \"FromBase64String\" ascii wide\n // Anti-analysis check strings\n $s5 = \"Win32_ComputerSystem\" ascii wide\n $s6 = \"SbieDll\" ascii wide\n $s7 = \"IsAttached\" ascii wide\n condition:\n uint16(0) == 0x5A4D and\n filesize < 500KB and\n $s1 and $s2 and $s3 and $s4 and\n 2 of ($s5, $s6, $s7)\n}", "pattern_type": "yara", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f97906fe-a141-5e09-8af9-92c284e4eaf1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T06:31:47.983607Z", "modified": "2026-10-11T08:16:41.523754Z", "name": "One-Minute Highest-Privilege Scheduled Task With an AppData Roaming Path (XWorm Persistence Pattern)", "indicator_types": [ "malicious-activity" ], "pattern": "title: One-Minute Highest-Privilege Scheduled Task With an AppData Roaming Path (XWorm Persistence Pattern)\nid: 94b6c01a-db65-4aa1-82c5-46eebc0c8ee5\nstatus: experimental\ndescription: |\n Detects a schtasks.exe command line that creates a task (/create) every minute (/sc minute\n with /mo 1 followed by a space or ending the line) at highest privilege (/rl highest) where the command line\n contains \\AppData\\Roaming\\. The report records this as the most aggressive of XWorm 3.0-5.0's\n three redundant persistence mechanisms: the one-minute interval gives near-instant re-execution\n after process termination, the highest-privilege flag requests an elevated context, the task\n name is derived from the install filename (typically \"XWormClient\") and the action points to the\n malware binary in %AppData%. The rule tests none of the task name, the action or the binary, and\n the AppData\\Roaming path may appear anywhere in the command line.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.persistence\n - attack.execution\n - attack.privilege-escalation\n - attack.t1053.005\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_cmd:\n Image|endswith: '\\schtasks.exe'\n CommandLine|contains|all:\n - '/create'\n - '/sc minute'\n - '/rl highest'\n selection_mo_mid:\n CommandLine|contains: '/mo 1 '\n selection_mo_end:\n CommandLine|endswith: '/mo 1'\n selection_path:\n CommandLine|contains:\n - '\\AppData\\Roaming\\'\n condition: selection_cmd and (selection_mo_mid or selection_mo_end) and selection_path\nfalsepositives:\n - No known legitimate software creates one-minute interval scheduled tasks at HIGHEST privilege whose command line contains AppData\\Roaming (the path is tested anywhere on the command line, not as the task action)\nlevel: high", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2dc76a31-1838-5988-a6df-7f6cc1834553", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.312906Z", "modified": "2026-10-11T07:42:16.016715Z", "name": "Shadow RAT Registry Run Key Persistence", "indicator_types": [ "malicious-activity" ], "pattern": "title: Shadow RAT Registry Run Key Persistence\nid: ff8d332d-4f1f-44d7-89ac-5d4373f4a341\nstatus: experimental\ndescription: |\n Detects a registry write for Shadow RAT v2.6.4.0 persistence by either of two alternatives: a\n Run key value named \"Shadow Client Startup\", or any value under a CurrentVersion\\Run key whose data\n contains \\SubDir\\Client.exe or \\SubDir\\$77Client.exe (the report records the install path at\n %APPDATA%\\SubDir\\Client.exe or %APPDATA%\\SubDir\\$77Client.exe, depending on the build variant,\n staging or production). Either alternative alone fires, so the install-path alternative matches\n under a different value name. A hit is a Run-key persistence lead resting on those two\n build-chosen literals; the install-path alternative needs no family identifier, and\n SubDir\\Client.exe is a generic path that unrelated software can use.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1547.001\n - detection.emerging-threats\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection_key:\n TargetObject|endswith: '\\CurrentVersion\\Run\\Shadow Client Startup'\n selection_data:\n Details|contains:\n - '\\SubDir\\Client.exe'\n - '\\SubDir\\$77Client.exe'\n selection_run_key:\n TargetObject|contains: '\\CurrentVersion\\Run\\'\n condition: selection_key or (selection_data and selection_run_key)\nfalsepositives:\n - No known legitimate software uses the registry value name \"Shadow Client Startup\"\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--840931dc-114e-5c1f-a4f7-55a9d4f493da", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T06:31:47.983818Z", "modified": "2026-10-11T08:16:41.524024Z", "name": "AMSI Library Load by a Process Outside System32, Program Files and Common Interpreters (AMSI Patching Pattern)", "indicator_types": [ "malicious-activity" ], "pattern": "title: AMSI Library Load by a Process Outside System32, Program Files and Common Interpreters (AMSI Patching Pattern)\nid: b02fa532-5fdd-4307-9a33-0d5935ffc4d0\nstatus: experimental\ndescription: |\n Detects a process loading a DLL named amsi.dll (from any path) when the loading process's\n own image is not one of powershell.exe, pwsh.exe, dotnet.exe, csc.exe or msbuild.exe and is\n not under C:\\Windows\\System32\\, C:\\Windows\\SysWOW64\\, C:\\Program Files\\ or\n C:\\Program Files (x86)\\. Shadow RAT v2.6.4.0 loads amsi.dll to resolve and patch\n AmsiScanBuffer; the report records a 15-byte patch and annotates it as returning E_INVALIDARG\n (0x80070057), but the recorded bytes were not verified to do so (see the AMSI YARA rule), so\n the intended blinding of in-memory .NET scanning is the report's account, not a tested effect. The path test is on the loading process, not on where\n amsi.dll was loaded from, so the genuine System32 amsi.dll loaded by an unexpected process\n matches; a hit is a hunting lead for an AMSI patching attempt, not proof of one.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.defense-impairment\n - attack.t1685\n - detection.emerging-threats\nlogsource:\n category: image_load\n product: windows\ndetection:\n selection:\n ImageLoaded|endswith: '\\amsi.dll'\n filter_legitimate:\n Image|endswith:\n - '\\powershell.exe'\n - '\\pwsh.exe'\n - '\\dotnet.exe'\n - '\\csc.exe'\n - '\\msbuild.exe'\n filter_system:\n Image|startswith:\n - 'C:\\Windows\\System32\\'\n - 'C:\\Windows\\SysWOW64\\'\n - 'C:\\Program Files\\'\n - 'C:\\Program Files (x86)\\'\n condition: selection and not (filter_legitimate or filter_system)\nfalsepositives:\n - Legitimate .NET applications or IDE tooling running from non-standard installation paths (outside System32, Program Files and the listed interpreters) that load amsi.dll\n - Custom development environments or build pipelines running outside Program Files\n - Security research tools that explicitly load amsi.dll for testing purposes\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4f74826c-5fbc-58f0-870d-f795e2848a13", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313055Z", "modified": "2026-10-01T19:54:20.313055Z", "name": "ETW Bypass via Process Access to ntdll.dll Memory Region", "indicator_types": [ "malicious-activity" ], "pattern": "title: ETW Bypass via Process Access to ntdll.dll Memory Region\nid: 7e1f94cd-ed21-4cc9-b3d4-4b14308210c0\nstatus: experimental\ndescription: |\n Detects processes acquiring full memory access rights to another process with call stack\n activity in ntdll.dll, consistent with ETW patching. Shadow RAT v2.6.4.0 patches\n ntdll.dll!EtwEventWrite with a single RET instruction (0xC3) via WriteProcessMemory,\n causing all ETW events from the process to silently return without logging. This blinds\n EDR tools and security monitoring products that rely on ETW for .NET CLR event visibility.\n The GrantedAccess value 0x1FFFFF indicates full process access including write permissions.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.defense-impairment\n - attack.t1685\n - detection.emerging-threats\nlogsource:\n category: process_access\n product: windows\ndetection:\n selection:\n GrantedAccess|contains:\n - '0x1FFFFF'\n - '0x1F0FFF'\n CallTrace|contains: 'ntdll.dll'\n filter_self:\n SourceImage|endswith:\n - '\\svchost.exe'\n - '\\lsass.exe'\n - '\\csrss.exe'\n - '\\services.exe'\n - '\\winlogon.exe'\n - '\\wininit.exe'\n condition: selection and not filter_self\nfalsepositives:\n - Debugging tools and performance profilers legitimately requesting full process access\n - Application compatibility shims that modify ntdll behavior at runtime\n - Security products performing integrity verification on ntdll.dll\n - Process monitoring tools with deep inspection capabilities\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--88de9ab5-02be-5e3d-bcf1-93d57b3517e1", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313127Z", "modified": "2026-10-01T19:54:20.313127Z", "name": "Windows Firewall Disabled via Netsh Opmode Command", "indicator_types": [ "malicious-activity" ], "pattern": "title: Windows Firewall Disabled via Netsh Opmode Command\nid: d7b42f19-3a58-4c82-9e31-0f5b8c2a6d94\nstatus: experimental\ndescription: |\n Detects Windows Firewall being disabled via netsh.exe using the \"firewall set opmode disable\"\n command sequence. Shadow RAT v2.6.4.0 includes explicit firewall disable capability in its\n command handler set, allowing operators to suppress host-based network filtering to enable\n unrestricted C2 communication or lateral movement. This command disables all Windows Firewall\n profiles simultaneously and is rarely issued in managed enterprise environments outside of\n explicit maintenance windows.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.defense-impairment\n - attack.t1686.003\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection:\n Image|endswith: '\\netsh.exe'\n CommandLine|contains|all:\n - 'firewall'\n - 'set'\n - 'opmode'\n - 'disable'\n condition: selection\nfalsepositives:\n - Legitimate administrators disabling Windows Firewall during planned maintenance or network reconfiguration\n - IT automation scripts that manage firewall state as part of policy enforcement workflows\n - Software installers that temporarily disable the firewall during service installation\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a2e7629e-6d25-5229-9d17-edaffbc16735", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.3132Z", "modified": "2026-10-01T19:54:20.3132Z", "name": "XWorm Registry Run Key Persistence Using Malware Install Name", "indicator_types": [ "malicious-activity" ], "pattern": "title: XWorm Registry Run Key Persistence Using Malware Install Name\nid: 68182796-ac58-45fa-a2c9-ed2843b5398f\nstatus: experimental\ndescription: |\n Detects XWorm 3.0-5.0 establishing registry Run key persistence using the value name\n \"XWormClient\", which matches the malware's default install filename. XWorm uses the\n install filename (without extension) as both the registry value name and the process mutex,\n creating a consistent and distinctive artifact. This is one of three redundant persistence\n mechanisms deployed simultaneously. The value data points to the malware binary in\n %AppData%\\Roaming\\.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1547.001\n - detection.emerging-threats\nlogsource:\n category: registry_set\n product: windows\ndetection:\n selection:\n TargetObject|endswith: '\\CurrentVersion\\Run\\XWormClient'\n Details|contains: '\\AppData\\Roaming\\XWormClient.exe'\n condition: selection\nfalsepositives:\n - No known legitimate software uses the registry value name \"XWormClient\"\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--66e517ac-7162-5c8d-bd0c-5fb0958e3f44", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313273Z", "modified": "2026-10-01T19:54:20.313273Z", "name": "Executable Shortcut Created in Windows Startup Folder by Non-System Process", "indicator_types": [ "malicious-activity" ], "pattern": "title: Executable Shortcut Created in Windows Startup Folder by Non-System Process\nid: a3c91e72-8f44-4b19-bd52-1f6a3c9d7e08\nstatus: experimental\ndescription: |\n Detects creation of a .lnk shortcut file inside the Windows Startup folder by a process\n outside system-managed directories. XWorm 3.0-5.0 creates a startup shortcut at\n %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\XWormClient.lnk via WScript.Shell\n COM automation as one of three redundant persistence mechanisms. Legitimate software\n installers creating startup shortcuts typically run from Program Files; a shortcut created\n by a process running from a user-writable path is a strong indicator of malware persistence.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.persistence\n - attack.privilege-escalation\n - attack.t1547.009\n - detection.emerging-threats\nlogsource:\n category: file_event\n product: windows\ndetection:\n selection:\n TargetFilename|contains: '\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\'\n TargetFilename|endswith: '.lnk'\n filter_legitimate:\n Image|startswith:\n - 'C:\\Windows\\'\n - 'C:\\Program Files\\'\n - 'C:\\Program Files (x86)\\'\n condition: selection and not filter_legitimate\nfalsepositives:\n - Software installers running from user-writable staging directories that create startup shortcuts as part of setup\n - Legitimate update managers or tray applications deployed outside Program Files that add startup shortcuts\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--487a633a-9080-5285-85c5-f8c3ba6ee880", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T07:42:16.01732Z", "modified": "2026-10-11T07:42:16.01732Z", "name": "Non-Browser Process DNS Query to ip-api.com (Host Name Used by XWorm's Hosting Check)", "indicator_types": [ "malicious-activity" ], "pattern": "title: Non-Browser Process DNS Query to ip-api.com (Host Name Used by XWorm's Hosting Check)\nid: ce5a51b5-1221-4843-ac57-3fa2b15ffb69\nstatus: experimental\ndescription: |\n Detects a process other than chrome.exe, firefox.exe, msedge.exe, iexplore.exe, brave.exe or\n opera.exe resolving the name ip-api.com or a name ending .ip-api.com, consistent with XWorm's\n anti-analysis hosting detection check. XWorm 3.0-5.0 queries http://ip-api.com/line/?fields=hosting\n at startup to determine whether the infected machine runs on hosting or datacenter infrastructure.\n If the API returns \"true\", the malware silently exits via Environment.Exit(0) to evade sandbox\n and researcher environments. A DNS query shows only the host name, not the /line/?fields=hosting\n path, and network tools, monitoring agents and other applications that use ip-api.com are not\n filtered, so a hit is a hunting lead and not proof of sandbox evasion.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.stealth\n - attack.discovery\n - attack.t1497.001\n - detection.emerging-threats\nlogsource:\n category: dns_query\n product: windows\ndetection:\n selection_exact:\n QueryName: 'ip-api.com'\n selection_sub:\n QueryName|endswith: '.ip-api.com'\n filter_browser:\n Image|endswith:\n - '\\chrome.exe'\n - '\\firefox.exe'\n - '\\msedge.exe'\n - '\\iexplore.exe'\n - '\\brave.exe'\n - '\\opera.exe'\n condition: (selection_exact or selection_sub) and not filter_browser\nfalsepositives:\n - Legitimate applications using ip-api.com for geolocation or network diagnostics\n - Network monitoring and IT asset management tools that use ip-api.com as a data source\n - Weather, travel, or location-aware desktop applications performing connectivity checks\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ff6e51f7-cfc9-5ef2-847e-63ecb19bbe51", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.31342Z", "modified": "2026-10-01T19:54:20.31342Z", "name": "WMI Win32_ComputerSystem Query from User-Writable Directory", "indicator_types": [ "malicious-activity" ], "pattern": "title: WMI Win32_ComputerSystem Query from User-Writable Directory\nid: e82e90ce-c1fd-46df-83af-91d73094a63f\nstatus: experimental\ndescription: |\n Detects WMI queries referencing Win32_ComputerSystem originating from a process whose parent\n executable resides in a user-writable directory (AppData or Temp). XWorm 3.0-5.0 queries\n Win32_ComputerSystem at startup to check the Manufacturer and Model fields for virtual machine\n indicators (VMware, VirtualBox, Hyper-V strings). This is one of six anti-analysis checks\n performed before any malicious behavior executes. Legitimate WMI inventory tools run from\n managed system paths, not user-writable locations.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.stealth\n - attack.discovery\n - attack.t1497.001\n - attack.t1082\n - detection.emerging-threats\nlogsource:\n category: process_creation\n product: windows\ndetection:\n selection_wmi:\n CommandLine|contains: 'Win32_ComputerSystem'\n selection_suspicious:\n ParentImage|contains:\n - '\\AppData\\Roaming\\'\n - '\\AppData\\Local\\Temp\\'\n condition: selection_wmi and selection_suspicious\nfalsepositives:\n - Legitimate system inventory or asset management tools running WMI queries from user-writable paths (unusual but possible in portable tool deployments)\n - IT automation scripts placed in AppData by software deployment systems\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bd10eafb-2df0-5a55-9a23-445b87de455e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-11T06:31:47.984518Z", "modified": "2026-10-11T07:42:16.017503Z", "name": "Zone.Identifier Stream Deleted From an Executable (.exe) by a Process Outside Browser and System Paths", "indicator_types": [ "malicious-activity" ], "pattern": "title: Zone.Identifier Stream Deleted From an Executable (.exe) by a Process Outside Browser and System Paths\nid: b78a5718-03c3-4e99-ab50-7fd048a70872\nstatus: experimental\ndescription: |\n Detects a file-delete event for the Zone.Identifier alternate data stream (ADS) of a file whose\n name ends .exe, by a process whose image is not chrome.exe, firefox.exe, msedge.exe or\n iexplore.exe and is not under C:\\Windows\\ or C:\\Program Files\\ (other browsers such as Brave\n and Opera are not excluded, and other executable extensions such as .dll, .scr and .msi are not\n covered). Both Shadow RAT and XWorm remove the Mark-of-the-Web\n (MOTW) from their own executables after installation to suppress Windows SmartScreen warnings\n on subsequent executions. Shadow RAT uses FileHelper.DeleteZoneIdentifier; XWorm performs a\n direct ADS stream deletion. Anchored on the file-delete event rather than file creation —\n file creation would match every downloaded file system-wide, since the ADS is created\n automatically on every download, and would be pure baseline noise.\nreferences:\n - https://the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/\nauthor: The Hunters Ledger\ndate: '2026-04-04'\ntags:\n - attack.defense-impairment\n - attack.t1553.005\n - detection.emerging-threats\nlogsource:\n category: file_delete\n product: windows\n definition: 'Requires Sysmon file-delete events. The sysmon conversion pipeline used here (EQL and Lucene) selects EventID 23 (FileDelete) only; EventID 26 (FileDeleteDetected) is not selected by the converted queries, so a deployment that reports the deletion as EID 26 needs its own mapping. Whether a deleted alternate data stream is reported as a TargetFilename ending in :Zone.Identifier depends on the Sysmon build and configuration and was not tested here.'\ndetection:\n selection:\n TargetFilename|endswith: '.exe:Zone.Identifier'\n filter_browser:\n Image|endswith:\n - '\\chrome.exe'\n - '\\firefox.exe'\n - '\\msedge.exe'\n - '\\iexplore.exe'\n filter_system:\n Image|startswith:\n - 'C:\\Windows\\'\n - 'C:\\Program Files\\'\n condition: selection and not (filter_browser or filter_system)\nfalsepositives:\n - Download managers or file transfer utilities that strip Zone.Identifier after checksum verification\n - Software deployment and packaging tools that remove MOTW from downloaded installers during staging\n - Self-updating legitimate software that clears its own Zone.Identifier stream after a user-consented first run\nlevel: medium", "pattern_type": "sigma", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--47fec467-3202-5cdc-8236-c262efebfe29", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313568Z", "modified": "2026-10-01T19:54:20.313568Z", "name": "THL HUNT TROJAN XWorm Anti-Analysis Hosting Check via ip-api.com", "indicator_types": [ "malicious-activity" ], "pattern": "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:\"THL HUNT TROJAN XWorm Anti-Analysis Hosting Check via ip-api.com\"; flow:established,to_server; http.host; content:\"ip-api.com\"; http.uri; content:\"/line/\"; content:\"fields=hosting\"; threshold:type limit,track by_src,count 1,seconds 3600; reference:url,the-hunters-ledger.com/hunting-detections/shadow-xworm-opendirectory-detections/; classtype:trojan-activity; sid:2026040403; rev:3; metadata:author The_Hunters_Ledger, date 2026-04-04;)", "pattern_type": "suricata", "valid_from": "2026-04-04T00:00:00Z", "labels": [ "detection-rule" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--a2679b1c-221e-5b15-83b3-3f1c9f269aeb", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313725Z", "modified": "2026-10-01T19:54:20.313725Z", "name": "Shadow RAT v2.6.4.0 production build", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--f2842a39-7b4f-55f3-a67e-227883a78e23", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313815Z", "modified": "2026-10-01T19:54:20.313815Z", "name": "XWorm 3.0-5.0 builder output #2", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--d8640bfa-e83d-5b2e-b534-8b9b612a986e", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313888Z", "modified": "2026-10-01T19:54:20.313888Z", "name": "Shadow RAT v2.6.4.0 staging/test build", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--c9f59c21-4b02-56dd-8676-02d413cce25b", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.313958Z", "modified": "2026-10-01T19:54:20.313958Z", "name": "Shadow RAT shared library", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "tool", "spec_version": "2.1", "id": "tool--295650c6-c3e5-5e73-a6c4-efc6b62d7701", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.314023Z", "modified": "2026-10-01T19:54:20.314023Z", "name": "XWorm 3.0-5.0 builder output #1", "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "infrastructure", "spec_version": "2.1", "id": "infrastructure--d5a101c9-8f52-5ba3-bd1f-9e6553c94c0c", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.314086Z", "modified": "2026-10-01T19:54:20.314086Z", "name": "shadow-xworm-opendirectory infrastructure", "infrastructure_types": [ "command-and-control", "hosting" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "report", "spec_version": "2.1", "id": "report--d362fb2d-05fc-5938-936e-670754d7a6d8", "created_by_ref": "identity--8bc8284b-deb5-546c-a233-57ea34b2ea0d", "created": "2026-10-01T19:54:20.314372Z", "modified": "2026-10-11T07:42:16.018595Z", "name": "Shadow RAT & XWorm Open Directory Campaign", "report_types": [ "threat-report" ], "published": "2026-04-04T00:00:00Z", "object_refs": [ "ipv4-addr--e476b5d2-7643-5710-bdca-4b1c3ac7359c", "indicator--3fee3b45-35a9-59d4-8549-5c770d1a7765", "ipv4-addr--e1594e3f-2aab-56a6-9dc9-23c303b9bb73", "indicator--c3deb49e-aa27-5677-9370-c0e1c110835f", "ipv4-addr--ec28d696-f1ad-51c0-8dc3-f13bbf365572", "indicator--50b7f29d-dc44-5138-a447-6aa1bdb265a2", "ipv4-addr--1971ae28-6029-59b9-b00e-83184a7cc1ba", "indicator--eb340713-edd6-5722-a7dd-db563b8dc218", "domain-name--631f35e8-b883-5c2d-a89c-90ebea0e8efb", "indicator--68d996c6-38c0-5cba-adb4-7ad15ef7e97f", "domain-name--b7e1a70f-5ffa-5c3a-8132-56d4e653919e", "indicator--fc29e995-7600-566d-b2fc-e10928d0f688", "domain-name--e38e6b03-407a-556b-b859-4305785e6108", "indicator--885d35bb-c36b-56a0-8c81-de2588cbe0e4", "domain-name--de523c66-8a81-5f9b-8603-eca98563c73b", "indicator--80946398-8430-566d-9101-be4e017231e5", "url--3e8b7700-5ca6-5cc1-a06c-6c6583a80b04", "domain-name--0ca16df1-cfaa-5df5-9349-cc8cc1b69daa", "indicator--7ad1cbf7-849a-5361-8566-b0fc424679bc", "file--666e21cb-6b32-5fd4-91f8-7be4924b6e24", "file--eaea1821-815f-5c6e-9531-b48fed0535b7", "file--7c64059e-9250-55ab-8c5a-a2751cee4ab8", "file--a64cfaaa-7d2f-5cec-8c16-88e8af11e1ae", "file--d86c9111-95fe-575d-9189-1de527523be0", "indicator--6e3aefb2-f3b6-549f-b588-065452144f61", "indicator--a96ee6be-d8c9-51a1-99a5-0dc3ee599c61", "indicator--30582b93-51ea-556c-a492-39b55de6cbba", "indicator--b62a9b40-db7a-51c8-9c12-6097c0b2f098", "indicator--3a21f2ea-92db-53e6-9cf1-01cff3fe67ad", "indicator--b36b85a8-4a34-5620-a622-6e64c278fb0a", "indicator--7f7af980-e0d7-5536-b5a8-eb288c4b9b04", "indicator--f97906fe-a141-5e09-8af9-92c284e4eaf1", "indicator--2dc76a31-1838-5988-a6df-7f6cc1834553", "indicator--840931dc-114e-5c1f-a4f7-55a9d4f493da", "indicator--4f74826c-5fbc-58f0-870d-f795e2848a13", "indicator--88de9ab5-02be-5e3d-bcf1-93d57b3517e1", "indicator--a2e7629e-6d25-5229-9d17-edaffbc16735", "indicator--66e517ac-7162-5c8d-bd0c-5fb0958e3f44", "indicator--487a633a-9080-5285-85c5-f8c3ba6ee880", "indicator--ff6e51f7-cfc9-5ef2-847e-63ecb19bbe51", "indicator--bd10eafb-2df0-5a55-9a23-445b87de455e", "indicator--47fec467-3202-5cdc-8236-c262efebfe29", "tool--a2679b1c-221e-5b15-83b3-3f1c9f269aeb", "tool--f2842a39-7b4f-55f3-a67e-227883a78e23", "tool--d8640bfa-e83d-5b2e-b534-8b9b612a986e", "tool--c9f59c21-4b02-56dd-8676-02d413cce25b", "tool--295650c6-c3e5-5e73-a6c4-efc6b62d7701", "infrastructure--d5a101c9-8f52-5ba3-bd1f-9e6553c94c0c" ], "labels": [ "RAT", "MaaS", "C2", "Multi-Family" ], "external_references": [ { "source_name": "The Hunters Ledger", "url": "https://the-hunters-ledger.com/reports/shadow-xworm-opendirectory/" } ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] } ] }