SourTrade — Browser-Assembled Malware via Malvertising

SourTrade is a malvertising operation, running since late 2024, whose objective is to land a Windows executable on the machines of retail traders and cryptocurrency investors. It buys programmatic display ads impersonating TradingView, Solana and Luno across 12 countries in 25 languages, and routes clickers to cloaked landing pages that show researchers and bots a blank white page while showing selected victims a convincing replica of the impersonated platform.

What makes it worth a hunt pack is the delivery, not the payload. The landing page never serves a finished binary. It registers a ServiceWorker at /sw.js, builds a SharedWorker from JavaScript already embedded in the page, and has that worker request /config — which returns build instructions: a byte-copy template, a standaloneUrl pointing at a clean Bun runtime on separate infrastructure, and a per-session random seed and size. The browser fetches and decompresses the clean runtime, generates a large pseudorandom stream with AES-CTR, and walks the template to splice runtime bytes, generated bytes, and Base64-delivered PE header, section table and malicious JavaScriptCore bytecode into a finished PE in memory. The assembled stream is handed to the ServiceWorker and delivered as a same-origin download through a hidden iframe with a Content-Disposition: attachment header.

Rotating the seed and size on every /config response changes the hash while keeping the payload code identical. That is the whole point of the design, and it is what dictates the defensive posture in this pack: the durable detections here are behavioral, not atomic. A browser process writing a fresh, oversized, unsigned PE into the user's download path and that PE subsequently executing is the signal that survives seed rotation. The three published SHA-256 hashes do not — they are the specific builds one researcher happened to capture.

Two honest scope limits, both drawn from the corroborating reporting rather than the vendor post. First, Mark of the Web is not stripped: MotW is applied, but it records the landing page as the download source rather than the separate host that supplied the Bun runtime, so the provenance is misleading rather than absent. Second, the credential-theft, keylogging and wallet-theft capability documented in the related September 2025 TradingView cluster (payload tracked as JSCEAL / WeevilProxy) has not been demonstrated for the three samples published here. Treat post-execution behavior as an intelligence gap, not a known quantity.

Defender priority: hash-based prevention is structurally defeated by this delivery model, so lead with prevalence-based execution control — Defender ASR rule 01443614-cd74-433a-b99e-2ecdc07bfc25 ("Block executable files from running unless they meet a prevalence, age, or trusted list criterion") blocks a per-victim unique build precisely because it has zero prevalence. Deploy it in audit mode today, pair it with Q1/Q2/Q6 for detection, and treat the 96 published domains as a detect-and-pivot list rather than the control that saves you.

Research decisions and corrections

• Domain count corrected to 96. The tasking brief said 113 domains. The published IOC list in the primary source contains exactly 96 entries, and The Hacker News independently counted 96. This pack ships 96 and cites 96.
• Activity start date. The primary source's executive summary and both corroborating outlets say "late 2024"; the same post's conclusion says "active since 2025". Used late 2024, the figure carried by three of four sources.
• Payload capability deliberately not carried forward. The stealer capabilities belong to the related Bitdefender-documented cluster, not to the three samples published here. §14 therefore treats confirmed execution as a credential-compromise event on precautionary grounds while §15 records the payload as an open intelligence gap.
• Cross-platform claim dropped. The assembled artifact documented here is a Windows PE built on a Bun standalone runtime. The macOS/Android breadth in the T3 reporting is inherited from the earlier cluster and is not established for this delivery chain, so this pack scopes detections to Windows.
• jimmywarting.github.io is a legitimate site and is NOT an indicator. It is the GitHub Pages address of the open-source StreamSaver.js author. Pre-May-2026 SourTrade variants loaded that library from there, which is why it appears inside historical Mark-of-the-Web artifacts. Blocking it would break an unrelated open-source project and detect nothing. The attacker-owned value in that historical MotW URL is the origin host embedded in its path, carried in §4 as a low-durability pivot.
• No injected instructions found. All six fetched sources were read as data. None contained text directing the reader to run commands, fetch further "real IOC" locations, alter output paths, or claim prior authorisation. No source-suggested value was placed in the import CSV.

Perishability: the 96 domains are the most volatile element here — this is a high-volume ad operation that rotates infrastructure continuously, and the list is a snapshot as of 2026-07-23. The behavioral queries (Q1, Q2, Q3, Q6) carry the pack's long-term value; re-pull the domain list before relying on §4 more than a few weeks out.

Hunt hypotheses (ordered by fidelity)

Attack chain and telemetry

Read the durability column before importing anything. This campaign rotates the AES-CTR seed and size per victim by design, so the hashes below are not campaign signatures — they are three captured builds. They are shipped as detect, never prevent, because a prevention rule on them buys nothing and a clean sweep result would be actively misleading.

Mapping note: Defender ASR rule d3e037e1-3eb8-44c8-a917-57927947596d ("Block JavaScript or VBScript from launching downloaded executable content") looks like an exact match for this threat and is not one. Per Microsoft's own reference it depends on the Antimalware Scan Interface and targets Windows Script Host scripts, not JavaScript executing inside a browser's renderer sandbox. Deploy it on its own merits; do not count it as coverage for SourTrade.

Non-CQL checks. The Mark-of-the-Web read is the single highest-value item here: because SourTrade delivers same-origin, the Zone.Identifier alternate data stream names the actual landing page, which is how you confirm an ad-referred download and recover a domain that may not be in the published 96.

1 — Read Mark of the Web on a suspect download (PowerShell)

Recovers HostUrl and ReferrerUrl, which reveal the landing-page domain and often the ad-network referral.

Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.exe |
  ForEach-Object {
    $z = Get-Content -Path $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue
    if ($z) {
      [PSCustomObject]@{
        File       = $_.Name
        SizeMB     = [math]::Round($_.Length / 1MB, 1)
        Created    = $_.CreationTimeUtc
        Signed     = (Get-AuthenticodeSignature $_.FullName).Status
        HostUrl    = ($z | Select-String 'HostUrl').Line
        ReferrerUrl= ($z | Select-String 'ReferrerUrl').Line
      }
    }
  } | Format-List

2 — List registered ServiceWorker origins in Chromium profiles

The SourTrade page registers a worker at /sw.js scoped to /. Registrations persist in a LevelDB store, so the origin remains recoverable after the browser is closed. Strings-grep the store rather than parsing it.

$roots = @(
  "$env:LOCALAPPDATA\Google\Chrome\User Data",
  "$env:LOCALAPPDATA\Microsoft\Edge\User Data",
  "$env:LOCALAPPDATA\BraveSoftware\Brave-Browser\User Data"
)
foreach ($r in $roots) {
  if (-not (Test-Path $r)) { continue }
  Get-ChildItem $r -Recurse -Directory -Filter "Service Worker" -ErrorAction SilentlyContinue |
    ForEach-Object {
      Write-Host "== $($_.FullName)"
      Get-ChildItem $_.FullName -Recurse -File -ErrorAction SilentlyContinue |
        Select-String -Pattern 'https?://[a-z0-9.-]+/sw\.js' -AllMatches -Encoding Byte |
        ForEach-Object { $_.Matches.Value } | Sort-Object -Unique
    }
}

3 — Chromium download history, including the referral chain

The downloads_url_chain table is the important one: it retains every hop, so a same-origin final URL still shows the ad-referred path that led to it. Copy the SQLite file before reading it — the browser holds a lock.

# Copy first (browser locks the live DB), then query with any sqlite3 client:
#   Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\History" "$env:TEMP\hist.db"
SELECT d.id,
       datetime(d.start_time/1000000 - 11644473600, 'unixepoch') AS started,
       d.total_bytes,
       d.target_path,
       d.tab_referrer_url,
       c.chain_index,
       c.url
FROM   downloads d
JOIN   downloads_url_chain c ON c.id = d.id
WHERE  d.target_path LIKE '%.exe'
ORDER  BY d.start_time DESC, c.chain_index ASC;

4 — Other native sources worth pulling

• Sysmon Event ID 15 (FileCreateStreamHash) — fires when the Zone.Identifier stream is created, giving you a timestamped record of the download plus the hash, even if the file is later deleted. Sysmon Event ID 11 (FileCreate) covers the write itself.
• Microsoft Defender ASR audit stream — action types AsrUntrustedExecutableAudited and AsrUntrustedExecutableBlocked. Once the §12 control 1 rule is in audit mode this is a direct, no-tuning feed of zero-prevalence executables launching.
• Defender AV Event IDs 1116 / 1117 (malware detected / action taken) on the Downloads path, and the Microsoft-Windows-SmartScreen/Debug channel for reputation blocks.
• Web proxy / SWG logs — hunt the structural sequence rather than a domain: a GET /sw.js and a GET /config on the same newly-seen host, followed within seconds by an executable-sized transfer from a different host. That cross-host split is the part the attacker cannot hide, because the runtime genuinely comes from elsewhere.
• DNS resolver / Protective DNS logs — the 96 domains from §10, plus a broader sweep for first-seen resolutions in the .digital, .info, .club, .site and .online TLDs from user endpoints, which is where this cluster's naming sits.

None of these queries carry an in-query time filter. CQL requires the right side of a comparison to be a literal, so @timestamp >= (now() - N) does not parse — set the window in the Falcon console instead (7 days is a reasonable default for Q1–Q6; go as wide as retention allows for Q7).

// HUNT: Browser process writes a new PE into a user download path (SourTrade stage 7)
// MITRE: T1027.006, T1027.004 | CONF: high  FP: medium  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten on Windows endpoints
// WINDOW: set 7d in the console. No in-query @timestamp filter -- CQL rejects an
//         expression on the right of a comparison, so now() - N is invalid here.
// TUNING: exclude your managed software-portal staging directory and vendor updater
//         bootstrappers. Sort by size descending -- a SourTrade build is tens of MB,
//         while most benign browser-written PEs in Downloads are small stubs.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| ContextBaseFileName=/^(chrome|msedge|firefox|brave|opera|vivaldi|iexplore)\.exe$/i
| TargetFileName=/\\(Downloads|Desktop)\\/i
| TargetFileName!=/(GoogleUpdateSetup|MicrosoftEdgeUpdate|FirefoxSetup|BraveBrowserSetup|OperaSetup)/i
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, FileSize, SHA256HashData, AuthenticodeHashData])

// HUNT: Browser is the direct parent of an executable in a user-writable path
// MITRE: T1204.002, T1036.005 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// TUNING: exclude Teams/Zoom/Slack/Webex web-launch helpers and signed vendor updaters.
//         Cross-check survivors against Q1 on the same aid -- a hit in both is the
//         full write-then-run chain and should be escalated ahead of either alone.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(chrome|msedge|firefox|brave|opera|vivaldi|iexplore)\.exe$/i
| ImageFileName=/\\(Downloads|Desktop|Temp)\\/i
| ImageFileName!=/\\(Teams|Zoom|Slack|Webex|GoogleUpdate|MicrosoftEdgeUpdate)\\/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, FileName, ImageFileName, CommandLine, SHA256HashData])

// HUNT: Browser writes an unusually large PE -- the Bun-standalone-plus-padding shape
// MITRE: T1027.009, T1027.014 | CONF: medium  FP: medium  COST: low
// REQUIRES: PeFileWritten / NewExecutableWritten with FileSize populated.
//   VALIDATE FIRST: drop the FileSize stage and confirm the field is non-empty in your
//   tenant. If it is not populated, this query returns nothing forever and silently.
// TUNING: exclude signed installers -- a populated AuthenticodeHashData means the PE
//         carries an Authenticode signature, and the assembled SourTrade build does not.
//         Also exclude engineering hosts, where large single-file builds are routine.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/
| ContextBaseFileName=/^(chrome|msedge|firefox|brave|opera|vivaldi)\.exe$/i
| FileSize >= 40000000
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, TargetFileName, FileSize, AuthenticodeHashData, SHA256HashData])

// HUNT: DNS resolution of published SourTrade landing pages and the Bun-runtime host
// MITRE: T1583.008, T1189, T1105 | CONF: high  FP: low  COST: low
// REQUIRES: DnsRequest
// NOTE: 96 landing domains plus purelogicbox.org, verbatim from the vendor IOC list as
//       of 2026-07-23. Infrastructure rotates -- a miss is inconclusive, not clean.
#event_simpleName=/^DnsRequest$/
| in(DomainName, values=[
    "purelogicbox.org",
    "noxani.info", "greensite.digital", "yuntaro.digital", "nexlisa.info",
    "vashiro.info", "campainter.digital", "riovera.info", "lunavo.club",
    "hanzoa.digital", "authcom.digital", "fererro.digital", "zythera.info",
    "angelxc.digital", "toushere.digital", "auronix.digital", "quorivamesh.digital",
    "junora.digital", "savanhe.digital", "tenderi.digital", "dexarionrte.info",
    "zuvex.digital", "minaro.club", "praxnova.info", "zuvex.club",
    "kalviorix.info", "thaivex.digital", "form-engine.digital", "solventa.club",
    "form-networktool.digital", "electmu.digital", "zenovapc.site", "qumoro.site",
    "insightcores.digital", "pulsewave-glow.digital", "ignite-spark.digital", "riberaz.com",
    "polvexa.site", "viewsafc.online", "insightmetrix.digital", "webnity.site",
    "cirevia1.digital", "tvviewreach.digital", "alteira.digital", "dalasu.digital",
    "parixaxj.com", "trustconnect.digital", "torvianet.site", "nebive.site",
    "forecastlogiccore.digital", "netkorava.digital", "forecasthub.digital", "dotlor.site",
    "koravaje.digital", "signalmetrics.digital", "forecastbridge.digital", "lakorava.digital",
    "pustou.site", "insightorbithub.digital", "dataroutehub.digital", "datasyncengine.digital",
    "forecastdeltaflow.digital", "forecastlogicflow.digital", "metricforge.digital",
    "forecastpulsegrid.digital", "robejj.com", "predictcore.digital", "dataplanehub.site",
    "oneclickme.site", "prolega.site", "nameprod.site", "transoe.site",
    "orientstrategypartners.digital", "beamoramag.digital", "beammaybea.digital",
    "urbanleafy.info", "brightmosaic.info", "forthlira.digital", "sobeamora.digital",
    "topbeamora.digital", "mortarora.digital", "lunarohub.info", "worldsol.site",
    "mindflowbase.info", "insight-radiant.digital", "nordexastudio.info",
    "cognitionpipeline.digital", "cognitionnodehub.digital", "acuitycore.digital",
    "radiantsynaptic.digital", "sapience-flare.digital", "engineclaritynode.digital",
    "flare-hub.digital", "beacon-net.digital", "brainyclevercore.digital",
    "syscodeapi.digital", "asiadataintelligencelab.digital"
  ])
| table([@timestamp, aid, ComputerName, UserName, DomainName, ContextBaseFileName])

// HUNT: Bun JavaScript runtime executing from a user-writable directory
// MITRE: T1105, T1027.004 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 / SyntheticProcessRollup2
// TUNING: Bun is legitimate software. Exclude your engineering asset group and any
//         managed dev-tools install path, then treat what is left as anomalous by host
//         role. Baseline with groupBy([ComputerName]) before promoting to an alert.
// NOTE: matched on FileName (basename) so the regex needs no path separator escaping.
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^bun(\.exe)?$/i
| ImageFileName=/\\(Downloads|Desktop|Temp|AppData)\\/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, CommandLine, ParentBaseFileName, SHA256HashData])

// HUNT: Same host shows both browser-write-to-Downloads and execute-from-Downloads
// MITRE: T1027.006, T1204.002 | CONF: high  FP: medium  COST: medium
// REQUIRES: PeFileWritten/NewExecutableWritten AND ProcessRollup2 in the same window
// TUNING: exclude the software-portal staging path and vendor installer basenames. Rank
//         survivors by FileSize descending and by absent AuthenticodeHashData -- the
//         assembled build is both large and unsigned, ordinary installers rarely both.
#event_simpleName=/^(PeFileWritten|NewExecutableWritten|ProcessRollup2|SyntheticProcessRollup2)$/
| selfJoinFilter(field=[aid], where=[
    {#event_simpleName=/^(PeFileWritten|NewExecutableWritten)$/ | ContextBaseFileName=/^(chrome|msedge|firefox|brave|opera|vivaldi)\.exe$/i | TargetFileName=/\\Downloads\\/i},
    {#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2)$/ | ImageFileName=/\\Downloads\\/i}
  ])
| table([@timestamp, aid, ComputerName, UserName, ContextBaseFileName, ParentBaseFileName, FileName, TargetFileName, ImageFileName, FileSize, SHA256HashData])

// HUNT: Retrospective hash sweep -- the three published SourTrade sample builds
// MITRE: T1027.014 | CONF: high  FP: low  COST: low
// REQUIRES: SHA256HashData on process or PE-write events
// NOTE: LOW DURABILITY BY DESIGN. Per-session seed rotation gives every victim a
//       different hash. Use Q1-Q6 for forward detection; this is a pivot only, and
//       an empty result is not evidence that the campaign has not touched the estate.
// WINDOW: widen to maximum retention -- this is a one-off backward look.
#event_simpleName=/^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| SHA256HashData=/^(9a29d26b94b708830c6eaea8a6c17616ec677adaf09114190d0e129564b2ca1b|05c0d056a6b3e76736d4f378541d28f24ecdf40060eeed24d8aa283d2f0120f6|ad542ed44df306bdcbb022ae210da74abad74e978cc1e3992016976282f31976)$/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ImageFileName, TargetFileName, SHA256HashData])

Two of the seven queries are worth promoting to Custom IOAs. The rest stay as investigate-only hunts, either because they are retrospective (Q7) or because domain indicators belong in IOC Management rather than an IOA rule group (Q4).

IOA-1 — Browser-parented execution from a user download path

IOA-2 — Oversized PE written into a user path by a browser

Not promoted, and why

• Q4 (domains) — belongs in Falcon IOC Management as 97 domain indicators with action detect, not in a Custom IOA. Import the CSV from §10. Domain IOAs would be harder to maintain as infrastructure rotates.
• Q7 (hashes) — retrospective only. Import the three hashes as detect indicators for visibility, but do not build a rule group around values that change per victim.
• Q5 (Bun runtime) — keep as a scheduled hunt. Bun is legitimate software and a Custom IOA on it would generate durable noise on engineering hosts for little gain over a weekly review.
• Q3 size stage — Custom IOA file-creation rules do not filter on file size, so IOA-2 deliberately omits it. Size remains a triage-time discriminator in the query.

Deployment path: create the rule group disabled, enable in a single pilot ring in Monitor, review a full week (expect installer noise to dominate), tune exclusions, then move to Detect estate-wide. Do not put either rule into Prevent — the prevention job here belongs to the prevalence-based ASR rule in §12, which discriminates on reputation rather than on path.

Every atomic value below is transcribed from a saved source snapshot in SourTrade-BrowserAssembled-Malvertising-Hunt-sources/. Nothing here is inferred, and there are no invented placeholders — the published indicator set is complete enough that none were needed.

type,value,action,severity,expiration,description,tags
# Assembled samples. action=detect, NOT prevent: per-session seed rotation means these
# three hashes are captured builds, not a campaign signature. Retrospective pivots only.
sha256,9a29d26b94b708830c6eaea8a6c17616ec677adaf09114190d0e129564b2ca1b,detect,high,2027-01-26,SourTrade browser-assembled PE sample,campaign:SourTrade
sha256,05c0d056a6b3e76736d4f378541d28f24ecdf40060eeed24d8aa283d2f0120f6,detect,high,2027-01-26,SourTrade browser-assembled PE sample,campaign:SourTrade
sha256,ad542ed44df306bdcbb022ae210da74abad74e978cc1e3992016976282f31976,detect,high,2027-01-26,SourTrade browser-assembled PE sample,campaign:SourTrade
# Secondary infrastructure: serves the clean Bun runtime named in standaloneUrl.
domain,purelogicbox.org,detect,high,2027-01-26,SourTrade Bun runtime staging host,campaign:SourTrade
# Historical: landing origin embedded in a pre-May-2026 StreamSaver-era MotW path.
domain,nwitassistnow.com,detect,medium,2026-10-26,SourTrade legacy landing origin from MotW artifact,campaign:SourTrade
# 96 cloaked landing-page domains, verbatim from the vendor IOC list (2026-07-23).
domain,noxani.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,greensite.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,yuntaro.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,nexlisa.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,vashiro.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,campainter.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,riovera.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,lunavo.club,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,hanzoa.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,authcom.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,fererro.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,zythera.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,angelxc.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,toushere.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,auronix.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,quorivamesh.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,junora.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,savanhe.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,tenderi.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,dexarionrte.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,zuvex.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,minaro.club,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,praxnova.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,zuvex.club,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,kalviorix.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,thaivex.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,form-engine.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,solventa.club,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,form-networktool.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,electmu.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,zenovapc.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,qumoro.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,insightcores.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,pulsewave-glow.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,ignite-spark.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,riberaz.com,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,polvexa.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,viewsafc.online,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,insightmetrix.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,webnity.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,cirevia1.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,tvviewreach.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,alteira.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,dalasu.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,parixaxj.com,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,trustconnect.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,torvianet.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,nebive.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forecastlogiccore.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,netkorava.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forecasthub.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,dotlor.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,koravaje.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,signalmetrics.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forecastbridge.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,lakorava.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,pustou.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,insightorbithub.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,dataroutehub.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,datasyncengine.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forecastdeltaflow.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forecastlogicflow.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,metricforge.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forecastpulsegrid.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,robejj.com,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,predictcore.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,dataplanehub.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,oneclickme.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,prolega.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,nameprod.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,transoe.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,orientstrategypartners.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,beamoramag.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,beammaybea.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,urbanleafy.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,brightmosaic.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,forthlira.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,sobeamora.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,topbeamora.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,mortarora.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,lunarohub.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,worldsol.site,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,mindflowbase.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,insight-radiant.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,nordexastudio.info,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,cognitionpipeline.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,cognitionnodehub.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,acuitycore.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,radiantsynaptic.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,sapience-flare.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,engineclaritynode.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,flare-hub.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,beacon-net.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,brainyclevercore.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,syscodeapi.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
domain,asiadataintelligencelab.digital,detect,high,2027-01-26,SourTrade cloaked landing page,campaign:SourTrade
# NOT an indicator, listed to prevent an accidental blocklist entry:
# jimmywarting.github.io is the legitimate GitHub Pages site of the open-source
# StreamSaver.js author. It appears in historical Mark-of-the-Web artifacts only.

SourTrade — behavioral signals that survive per-session hash rotation
=====================================================================
ENDPOINT (highest value first)
 1. Browser process is the writing context for a new PE under
    \Users\*\Downloads\ or \Users\*\Desktop\                        -> Q1
 2. Same host: browser-written PE in Downloads AND execution of a
    binary from Downloads within the same window                    -> Q6
 3. Browser is the direct parent of a process whose image lives in
    Downloads, Desktop or Temp                                      -> Q2
 4. Browser-written PE of 40 MB or more                             -> Q3
 5. Executable named bun / bun.exe running from a user-writable path -> Q5
 6. Assembled PE is unsigned: no Authenticode signature on a file
    the user believes is a major trading or wallet application

FILE STRUCTURE (triage of a recovered sample)
 7. Single-file PE built on a Bun standalone runtime; embedded
    JavaScriptCore engine
 8. PE section named .bun carrying JavaScriptCore bytecode for app.js
 9. Large high-entropy region with no structural role — the AES-CTR
    padding stream that varies the hash between victims

BROWSER / WEB (needs proxy or forensic access)
10. Same origin serves GET /sw.js and GET /config, then an
    executable-sized transfer arrives from a DIFFERENT host
11. /config response is JSON containing the keys: template,
    standaloneUrl, random.seed, random.size
12. Page JavaScript uses streamsaver: postMessage channel names
    (streamsaver:open, streamsaver:ping) with no StreamSaver.js fetch
13. Download delivered via hidden iframe navigation to a same-origin
    URL answered with Content-Disposition: attachment
14. Zone.Identifier HostUrl names the landing page, while the runtime
    actually came from separate infrastructure not recorded in MotW

NEGATIVE CONTROLS — do not alert on these alone
  - ServiceWorker registration (every progressive web app does it)
  - A Bun runtime on a developer workstation
  - jimmywarting.github.io (legitimate StreamSaver.js author's site)

Campaign     : SourTrade (Confiant designation). No actor attribution published.
Active since : late 2024, ongoing through 2026
Targeting    : retail traders and crypto investors; 12 countries, 25 languages
               Japan, Thailand, South Korea, Taiwan, Hong Kong, Bolivia, Brazil,
               Nigeria, Turkey, South Africa, Australia, Great Britain
Impersonates : TradingView, Solana, Luno
Ad ecosystems: Google Ads, Meta/Facebook pixel, Twitter/X beacons (tracking logic
               observed in the landing pages themselves)
Legit software abused:
  Bun          - JavaScript runtime; its standalone-executable build feature
                 supplies the clean PE base and the JavaScriptCore interpreter
  StreamSaver.js - streamed-download library; abandoned as a fetch dependency
                 after 2026-04-30 but its message-channel names persist

ATTRIBUTION BOUNDARY — read before writing an incident summary
  The related TradingView malvertising cluster documented by Bitdefender in
  September 2025 delivered a stealer tracked as JSCEAL (Check Point) and
  WeevilProxy (WithSecure), with credential theft, keylogging, traffic
  interception, wallet theft and remote access. Confiant identifies shared
  campaign and executable characteristics but does NOT demonstrate that the
  three published samples carry that payload, and the Bitdefender post it
  cites names its loader detection Variant.DenoSnoop.Marte.1 rather than Bun.
  Do not state those capabilities as fact for this delivery chain.

SCOPE CORRECTIONS applied in this pack
  - 96 domains published, not 113
  - Mark of the Web is APPLIED, not bypassed; only its recorded source is
    misleading
  - No browser vulnerability is involved and there is no patch to apply
  - Whether the download starts automatically or needs a click is not
    established by the source reporting
  - Windows PE only; the macOS/Android breadth belongs to the earlier cluster

# SourTrade prevention-posture audit -- run elevated. Read-only, changes nothing.

Write-Host "`n=== 1. Cloud protection (hard dependency of the prevalence ASR rule) ==="
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent, DisableRealtimeMonitoring

Write-Host "`n=== 2. ASR rule state -- looking for the prevalence rule ==="
$prevalence = '01443614-cd74-433a-b99e-2ecdc07bfc25'
$p = Get-MpPreference
if (-not $p.AttackSurfaceReductionRules_Ids) {
  Write-Host "  NO ASR RULES CONFIGURED -- see section 12 control 1" -ForegroundColor Red
} else {
  for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    $id  = $p.AttackSurfaceReductionRules_Ids[$i]
    $act = switch ($p.AttackSurfaceReductionRules_Actions[$i]) {
             0 {'Disabled'} 1 {'Block'} 2 {'Audit'} 6 {'Warn'} default {'Unknown'} }
    $tag = if ($id -eq $prevalence) { '  <== THE SOURTRADE CONTROL' } else { '' }
    Write-Host ("  {0} = {1}{2}" -f $id, $act, $tag)
  }
}

Write-Host "`n=== 3. Browser download and reputation policy ==="
$keys = @(
  @{ Path='HKLM:\SOFTWARE\Policies\Google\Chrome';   Names=@('DownloadRestrictions','SafeBrowsingProtectionLevel') },
  @{ Path='HKLM:\SOFTWARE\Policies\Microsoft\Edge';  Names=@('DownloadRestrictions','SmartScreenEnabled','SmartScreenPuaEnabled') }
)
foreach ($k in $keys) {
  Write-Host "  $($k.Path)"
  foreach ($n in $k.Names) {
    $v = (Get-ItemProperty -Path $k.Path -Name $n -ErrorAction SilentlyContinue).$n
    if ($null -eq $v) { Write-Host "    $n = NOT SET" -ForegroundColor Yellow }
    else              { Write-Host "    $n = $v" }
  }
}

Write-Host "`n=== 4. Application control posture ==="
Get-CimInstance -Namespace root\Microsoft\Windows\DeviceGuard `
  -ClassName Win32_DeviceGuard -ErrorAction SilentlyContinue |
  Select-Object CodeIntegrityPolicyEnforcementStatus, UsermodeCodeIntegrityPolicyEnforcementStatus
Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue |
  Select-Object -ExpandProperty RuleCollections | Select-Object PathType, EnforcementMode

Write-Host "`n=== 5. Existing suspect downloads on this host ==="
Get-ChildItem "$env:USERPROFILE\Downloads" -Filter *.exe -ErrorAction SilentlyContinue |
  Where-Object { $_.Length -gt 40MB } |
  Select-Object Name, @{n='MB';e={[math]::Round($_.Length/1MB,1)}},
                CreationTimeUtc,
                @{n='Signed';e={(Get-AuthenticodeSignature $_.FullName).Status}}

Work these in order. Gate 1 is not optional — this entire pack rests on one telemetry assumption, and if it is false every query returns zero rows and looks like a clean estate.

Gate 1 — Telemetry ready

• Run Q1 with the ContextBaseFileName and TargetFileName stages removed over 24 hours. If PeFileWritten / NewExecutableWritten return nothing, the sensor is not emitting PE-write telemetry and Q1, Q3 and Q6 are blind. Fix that before anything else.
• Confirm FileSize is populated on those events. If it is empty, drop the size stage from Q3 (documented in the query's own comments) and use size as a triage-time sort instead.
• Confirm AuthenticodeHashData appears for known-signed installers. If it is always empty, the unsigned discriminator in Q3 and Q6 tuning is unusable in your tenant.
• Confirm DnsRequest is enabled for the user population, not just servers — Q4 depends on it and endpoint DNS visibility is commonly scoped narrowly.

Gate 2 — Benign baseline

• Run Q1, Q2 and Q5 over 14 days with no exclusions and group by ComputerName and file basename. Enumerate every legitimate writer and installer that appears; those become your exclusion list, not a guess made in advance.
• Expect Q2 to be dominated by user-initiated software installs. Q6 should be a small fraction of Q1's volume — if it is not, your Downloads-execution baseline is unusually high and the correlation loses value until that is understood.
• Identify the engineering asset group before tuning Q5. Bun on a developer workstation is normal; the query is about host role.

Gate 3 — Positive test (safe, no malicious code)

• Q1 / Q2 / Q6: from a lab host, download any large legitimate signed installer through the browser and launch it from the download shelf. All three should fire. This proves the telemetry path end to end without touching the campaign.
• Q3 / Q5: on a lab host, build a hello-world Bun standalone with the vendor's own compile feature and run it from Downloads. That reproduces the file shape SourTrade abuses — large single-file PE, embedded JavaScriptCore, bun basename if unrenamed — with no malicious content at all.
• Q4: validate the query mechanically by temporarily substituting a domain you control into the in() list and resolving it. Do not resolve the campaign domains from a corporate endpoint.
• Q7: no safe positive test exists and none is needed — it is an exact-match sweep. Confirm only that the query parses and returns the expected empty result.

Gate 4 — Promotion criteria

• Promote Q6 to a scheduled search first. Target fewer than 10 events per 1,000 endpoints per day after tuning; above that, tighten the path list before alerting anyone.
• Promote Q2 to Custom IOA Detect (IOA-1) only after a full week of pilot-ring monitoring shows the installer noise is bounded and excluded.
• Keep Q1 and Q3 as informational feeds behind IOA-2 rather than paging alerts — their job is to give Q6 something to correlate.
• Do not promote anything to Prevent. The prevention decision belongs to the prevalence-based ASR rule in §12, which discriminates on file reputation rather than on path and therefore does not break legitimate installs.
• Re-validate the §10 domain list before relying on Q4 more than a few weeks after 2026-07-23.

The surfaces this threat actually touches are Windows endpoint execution control, browser download policy, and web/DNS egress. There is no server, appliance, cloud or identity surface in this chain, and no patch to apply — the delivery abuses documented browser features working as designed.

Raw configuration for the three highest-leverage controls. Every step carries prerequisites, reboot status and a rollback, because each of these changes endpoint state.

PB1 — Prevalence-based ASR rule: audit, then block

Prerequisites: Microsoft Defender Antivirus in active mode; cloud-delivered protection enabled (a hard dependency — the rule is inert without it); local administrator or an Intune/GPO deployment channel; a pilot ring identified.
Reboot required: No.
Rollback: step 5 below — set the rule to Disabled, or remove the rule ID entirely. Takes effect immediately, no reboot.

# ---------- PB1: ASR 01443614 "block low-prevalence executables" ----------
# 1. Satisfy the hard dependency first. Without cloud protection the rule does nothing.
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendSafeSamples
Get-MpPreference | Select-Object MAPSReporting, SubmitSamplesConsent

# 2. Add the rule in AUDIT mode. Never start at Block -- this rule evaluates reputation
#    across every executable on the host, and your own line-of-business tools may be
#    low-prevalence too.
$rule = '01443614-cd74-433a-b99e-2ecdc07bfc25'
Add-MpPreference -AttackSurfaceReductionRules_Ids $rule `
                 -AttackSurfaceReductionRules_Actions AuditMode

# 3. Verify it is applied and in the mode you expect.
$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
  if ($p.AttackSurfaceReductionRules_Ids[$i] -eq $rule) {
    $act = switch ($p.AttackSurfaceReductionRules_Actions[$i]) {
             0 {'Disabled'} 1 {'Block'} 2 {'Audit'} 6 {'Warn'} default {'Unknown'} }
    Write-Host "ASR $rule = $act"
  }
}

# 4. Review AsrUntrustedExecutableAudited for 7-14 days before switching to Block.
#    In Defender/Sentinel advanced hunting:
#      DeviceEvents
#      | where ActionType == "AsrUntrustedExecutableAudited"
#      | summarize Hosts=dcount(DeviceName), Hits=count() by FolderPath, FileName
#      | order by Hits desc
#    Add a per-rule exclusion for anything legitimate, then:
Set-MpPreference -AttackSurfaceReductionRules_Ids $rule `
                 -AttackSurfaceReductionRules_Actions Enabled   # Enabled == Block

# 5. ROLLBACK -- immediate, no reboot. Either disable in place:
Set-MpPreference -AttackSurfaceReductionRules_Ids $rule `
                 -AttackSurfaceReductionRules_Actions Disabled
#    or remove the rule from the configured set entirely:
Remove-MpPreference -AttackSurfaceReductionRules_Ids $rule

PB2 — Browser download and reputation policy

Prerequisites: local administrator, or Intune / Group Policy / Chrome Enterprise Core. Read the caution below before choosing a value.
Reboot required: No — browser restart only.
Rollback: step 4 — delete the policy values. The browser reverts to user-controlled defaults on next launch.

Verify the value before you deploy it. Chrome and Edge publish different integer tables for DownloadRestrictions. Look the value up in the policy reference for your specific browser and channel and confirm what it does there; do not carry a number across from the other browser or from this pack. The example below uses 1 as the conservative "block dangerous downloads" setting per Edge's published table — confirm that mapping for your estate, and pilot before broad rollout, since a stricter value can block legitimate downloads outright.

:: ---------- PB2: browser download + reputation policy (run elevated) ----------
:: 1. Download restriction. CONFIRM THE VALUE MAPPING FOR YOUR BROWSER FIRST.
reg add "HKLM\SOFTWARE\Policies\Google\Chrome"  /v DownloadRestrictions /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v DownloadRestrictions /t REG_DWORD /d 1 /f

:: 2. Reputation services. Chrome: 2 = Enhanced Safe Browsing. Edge: SmartScreen on,
::    plus potentially-unwanted-app blocking.
reg add "HKLM\SOFTWARE\Policies\Google\Chrome"  /v SafeBrowsingProtectionLevel /t REG_DWORD /d 2 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v SmartScreenEnabled          /t REG_DWORD /d 1 /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v SmartScreenPuaEnabled       /t REG_DWORD /d 1 /f

:: 3. Optional URL blocklist. For a 99-entry list prefer Falcon IOC Management or your
::    DNS filter -- URLBlocklist is an indexed key and does not scale gracefully here.
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\URLBlocklist"  /v 1 /t REG_SZ /d "purelogicbox.org" /f
reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist" /v 1 /t REG_SZ /d "purelogicbox.org" /f

:: VERIFY: relaunch the browser and open chrome://policy or edge://policy, then
:: "Reload policies" and confirm each value shows as applied with no conflict warning.

:: 4. ROLLBACK -- delete the values; effective on next browser launch.
reg delete "HKLM\SOFTWARE\Policies\Google\Chrome"  /v DownloadRestrictions        /f
reg delete "HKLM\SOFTWARE\Policies\Google\Chrome"  /v SafeBrowsingProtectionLevel /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v DownloadRestrictions        /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v SmartScreenEnabled          /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v SmartScreenPuaEnabled       /f
reg delete "HKLM\SOFTWARE\Policies\Google\Chrome\URLBlocklist"  /f
reg delete "HKLM\SOFTWARE\Policies\Microsoft\Edge\URLBlocklist" /f

PB3 — AppLocker: deny execution from user download paths (audit first)

Prerequisites: Windows Enterprise or Education for AppLocker enforcement; the AppIDSvc service running and set to automatic start; a pilot ring; an agreed exception process for staff who legitimately run downloaded binaries. Export the current policy before you start — step 1.
Reboot required: No, but AppIDSvc must be started and policy refresh can take up to 90 minutes without gpupdate /force.
Rollback: step 5 — re-import the policy exported in step 1. This is why step 1 is not optional.

# ---------- PB3: AppLocker deny-execute from user download paths ----------
# 1. ROLLBACK INSURANCE -- export the effective policy BEFORE changing anything.
Get-AppLockerPolicy -Effective -Xml | Set-Content C:\Temp\applocker-backup.xml -Encoding UTF8

# 2. Ensure the enforcement service is running and will survive reboot.
Set-Service -Name AppIDSvc -StartupType Automatic
Start-Service -Name AppIDSvc

# 3. Author an AUDIT-ONLY deny policy for the two paths this threat lands in.
#    AuditOnly logs to Microsoft-Windows-AppLocker/EXE and DLL without blocking.
$policy = @'
<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="AuditOnly">
    <FilePathRule Id="8f2c1a44-0d3b-4a7e-9c15-6b2e0f7a3d91"
                  Name="Deny EXE from user Downloads"
                  Description="SourTrade: browser-assembled PE lands here"
                  UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions><FilePathCondition Path="%OSDRIVE%\Users\*\Downloads\*"/></Conditions>
    </FilePathRule>
    <FilePathRule Id="1d7b93e5-42af-4c68-8e02-5a9c4f1b7e30"
                  Name="Deny EXE from user Desktop"
                  Description="SourTrade: alternate download target"
                  UserOrGroupSid="S-1-1-0" Action="Deny">
      <Conditions><FilePathCondition Path="%OSDRIVE%\Users\*\Desktop\*"/></Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>
'@
$policy | Set-Content C:\Temp\applocker-sourtrade.xml -Encoding UTF8
Set-AppLockerPolicy -XmlPolicy C:\Temp\applocker-sourtrade.xml -Merge

# 4. VERIFY, then review the audit log for 7-14 days before enforcing.
Get-AppLockerPolicy -Effective |
  Select-Object -ExpandProperty RuleCollections |
  Select-Object PathType, EnforcementMode
Get-WinEvent -LogName 'Microsoft-Windows-AppLocker/EXE and DLL' -MaxEvents 50 |
  Select-Object TimeCreated, Id, Message
# When the audit log contains only what you intend to block, change
# EnforcementMode to "Enabled" in the XML above and re-merge.

# 5. ROLLBACK -- restore the pre-change policy exported in step 1.
Set-AppLockerPolicy -XmlPolicy C:\Temp\applocker-backup.xml
gpupdate /force

PB4 — Import the published infrastructure as detect indicators

Prerequisites: Falcon administrator role with IOC Management write access; the CSV from §10.
Reboot required: No.
Rollback: filter IOC Management on tag campaign:SourTrade and bulk-delete, or let the 2027-01-26 expiration retire the entries on its own.

1. Copy the Falcon IOC Management CSV block from §10.
2. In the Falcon console open Endpoint security → IOC management and use the bulk upload path. Confirm the header row maps to type,value,action,severity,expiration,description,tags.
3. Keep every action as detect. Do not promote to prevent on import — see §4 for why the hashes in particular do not warrant it.
4. Confirm the campaign:SourTrade tag is applied to all rows; that tag is the rollback handle and the reporting filter.
5. Set a calendar reminder for 2026-08-26 to re-check the vendor post for a refreshed domain list. This infrastructure rotates continuously and a month-old list is materially degraded.

Precautionary basis: the post-execution behavior of the three published samples is not documented. The related earlier cluster delivered a credential and wallet stealer, so this runbook treats confirmed execution as a credential-compromise event. That is a deliberate precaution, not an established fact — record it that way in the incident notes.

Honest summary of coverage. Four of the nine chain steps have no endpoint telemetry at all, and that is a property of the attack rather than a gap in this pack: the ad click, the worker setup, the instruction fetch and the in-memory assembly are all either off-endpoint or inside browser memory. What the pack does cover is the two steps that matter for stopping harm — the assembled file hitting disk (Q1, Q3, IOA-2) and that file executing (Q2, Q5, Q6, IOA-1) — and those detections are indifferent to seed rotation, which is the whole reason this threat was worth a pack. Two gaps are closable with investment rather than research: TLS inspection with full-URL logging opens steps 4 and 5, and proxy referrer retention opens step 1. Two are not closable at all with current technology, and one (step 9) is an open intelligence question that should be revisited when payload analysis is published. Before trusting any result here, work §11 gate 1 — the entire behavioral core assumes PeFileWritten or NewExecutableWritten fires for browser writes in your tenant, and if it does not, this pack will return an empty set that looks exactly like a clean estate. Then work gate 2's benign baseline, because the FP medium ratings on Q1, Q2, Q3, Q5 and Q6 are real and every one of those queries will surface ordinary software installs until it is tuned against your own environment.

Next revision triggers: bump to v0.2 if payload analysis for the three published samples is released (which would close the §15 step-9 gap and let §14 drop its precautionary framing), or if a refreshed domain list supersedes §10. Bump to v1.0 once Q6 and IOA-1 are running in production after §11 gate 4.

Provenance: every atomic indicator shipped in §10 was transcribed from the snapshot files listed above, which hold the fetched text of each cited source as retrieved on 2026-07-26. Nothing in the import CSV originates from a value suggested by fetched page content, and no indicator was included that could not be traced back to a snapshot.