BusySnake Stealer — Armored Likho (Eagle Werewolf) APT

Looks for: a process named pnx.exe executing from an NSIS extraction dir (\Temp\nsn*.tmp\ / \Temp\). Accomplishes: catches the first-stage decoy dropper / injection target. FP: low — pnx.exe in a temp NSIS path is not a common legit pattern.

// HUNT: BusySnake NSIS dropper — injected pnx.exe from an nsn*.tmp temp dir
// MITRE: T1204.002, T1055 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: pnx.exe from an NSIS temp path is not a common legit binary
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^pnx\.exe$/i
| ImageFileName=/\\(Local\\Temp|Temp)\\(nsn.+\.tmp\\)?pnx\.exe$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData], limit=200)

Looks for: python.exe/pythonw.exe whose command line references module.pyw and/or the WindowsHelper working dir. Accomplishes: the flagship execution signature. FP: low — a portable Python running a .pyw out of %APPDATA%\WindowsHelper is not normal.

// HUNT: BusySnake stealer execution — module.pyw run from WindowsHelper
// MITRE: T1059.006 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: baseline sanctioned portable-Python automation writing to AppData
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(python|python3|pythonw)\.exe$/i
| CommandLine=/(\\WindowsHelper\\.+\.pyw|module\.pyw)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine, SHA256HashData], limit=200)

Looks for: wscript/cscript executing a .vbs/.pyw from a WindowsHelper path — the 5-minute re-launch task. Accomplishes: catches persistence firing. FP: low — WSH running from %APPDATA%\WindowsHelper is anomalous.

// HUNT: BusySnake persistence — WindowsHelper task re-launches run.vbs / module.pyw
// MITRE: T1053.005, T1059.005 | CONF: high  FP: low  COST: low | REQUIRES: ProcessRollup2
// FALSE POSITIVES: legit WSH rarely runs from %APPDATA%\WindowsHelper
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(wscript|cscript)\.exe$/i
| CommandLine=/\\WindowsHelper\\.+\.(vbs|pyw)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: creation of chromium_passwords.json / firefox_passwords.json / all_browser_data.json / inventory_state.db under a WindowsHelper directory. Accomplishes: a near-zero-FP tell that theft has run. FP: low — these exact staged filenames are BusySnake-specific.

// HUNT: BusySnake exfil staging — stealer output written under WindowsHelper
// MITRE: T1074.001, T1555.003 | CONF: high  FP: low  COST: low | REQUIRES: FileCreate telemetry
// FALSE POSITIVES: these exact staged filenames under WindowsHelper are malware-specific
#event_simpleName=/NewExecutableWritten|PeFileWritten|FileCreateInfo/
| TargetFileName=/\\WindowsHelper\\.*(chromium_passwords|firefox_passwords|all_browser_data|inventory_state)\.(json|db)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName], limit=200)

Looks for: a non-browser image opening many browser credential / wallet / Telegram tdata files. Accomplishes: BusySnake's core looting. FP: medium — some backup/security tools read these; require a high distinct-file count and a non-browser image (correlate to Q2 lineage).

// HUNT: BusySnake credential harvest — mass read of browser/wallet/Telegram secrets
// MITRE: T1555.003, T1539, T1005 | CONF: high  FP: medium  COST: med | REQUIRES: file-read telemetry
// TUNING: require many distinct targets + non-browser image; baseline backup/security tools
#event_simpleName=/FileOpenInfo/
| TargetFileName=/(\\User Data\\.+\\(Login Data|Cookies|Local State|Web Data)|key4\.db|logins\.json|\\Telegram Desktop\\tdata|wallet\.dat|\\MetaMask|keystore)/i
| ContextBaseFileName=/^(python|python3|pythonw|pnx)\.exe$/i
| groupBy([ComputerName, ContextBaseFileName], function=count(TargetFileName, distinct=true, as=files))
| files >= 4
| table([ComputerName, ContextBaseFileName, files], limit=200)

Looks for: ssh.exe invoked with a reverse-forward to 0.0.0.0 plus host-key checking disabled — the Armored Likho Go2Tunnel argument set. Accomplishes: flags hands-on-keyboard tunneling. FP: low-med — baseline any sanctioned ssh -R automation.

// HUNT: BusySnake reverse SSH tunnel — Go2Tunnel-style arguments
// MITRE: T1572 | CONF: high  FP: low-med  COST: low | REQUIRES: ProcessRollup2 + CommandLine
// TUNING: baseline sanctioned ssh -R jump-host automation before alerting
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^ssh\.exe$/i
| CommandLine=/-R\s+0\.0\.0\.0:|ExitOnForwardFailure=yes|StrictHostKeyChecking=no/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, FileName, CommandLine], limit=200)

Looks for: DNS resolution of the reported C2 / tunnel domains. Accomplishes: a cheap watchlist hit. FP: low, but the domains are perishable — confirm they are still live before treating a miss as clean.

// HUNT: BusySnake C2 DNS — known Armored Likho domains (perishable)
// MITRE: T1071.001 | CONF: medium  FP: low  COST: low | REQUIRES: DnsRequest
// FALSE POSITIVES: domains rotate; refresh from current threat intel
#event_simpleName=DnsRequest
| DomainName=/(winupdate\.(live|ink)|arvax\.xyz|varenie\.live|lvl99\.store|onetoken\.ink|grked\.online|ndrt\.ink|myboard\.(chickenkiller\.com|twilightparadox\.com))$/i
| table([@timestamp, ComputerName, ContextBaseFileName, DomainName], limit=200)

Looks for: outbound connections to the four reported C2 / tunnel IP addresses. Accomplishes: confirms exfil / tunnel egress. FP: low, but the IPs are perishable — treat as hunt, not a standalone block.

// HUNT: BusySnake C2 beacon — known Flask C2 / tunnel IPs (perishable)
// MITRE: T1041, T1071.001 | CONF: medium  FP: low  COST: low | REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: IPs rotate; confirm against current threat intel before blocking
#event_simpleName=NetworkConnectIP4
| in(RemoteAddressIP4, values=["159.198.41.140","159.198.75.219","159.198.32.222","69.67.173.153"])
| table([@timestamp, ComputerName, ContextBaseFileName, RemoteAddressIP4, RemotePort], limit=200)