MalwarePublished 16 Sep 2025

AppSuite, OneStart & ManualFinder: The Nexus of Deception

Source AlienVault OTX General

Description

This analysis reveals connections between three seemingly distinct malicious programs: AppSuite, OneStart, and ManualFinder. The investigation uncovers shared server infrastructure and similar installation patterns, indicating that these programs are likely created by the same threat actor. OneStart, initially a browser based on Chromium, evolved from earlier versions that used node.exe to run malicious JavaScript. The actors behind these programs have been active for years, distributing malware disguised as various utilities such as games, recipe finders, and manual finders. The report highlights the adaptability of these threat actors, who easily morph their software to take new forms and evade detection.

Impact

For European organizations, this threat presents a moderate risk primarily due to its stealthy nature and persistence capabilities. The malware’s disguise as legitimate utilities increases the likelihood of user execution, potentially leading to unauthorized access, data exfiltration, or further malware deployment. The use of living-off-the-land binaries and PowerShell scripts complicates detection and response efforts, potentially allowing prolonged presence within networks. Organizations in sectors relying heavily on browser-based tools or custom utilities may be particularly vulnerable. The adaptability of the threat actors means that traditional signature-based defenses may be insufficient, increasing the risk of successful compromise. While no critical exploits have been reported, the malware’s ability to maintain persistence and execute arbitrary code could impact confidentiality and integrity of sensitive data, disrupt operations, and erode trust in IT environments. European entities with less mature endpoint detection and response capabilities or those with extensive use of third-party utilities may face higher exposure.

Defensive guidance

1. Implement advanced endpoint detection and response (EDR) solutions capable of identifying living-off-the-land techniques and anomalous PowerShell usage. 2. Enforce strict application whitelisting policies to prevent unauthorized execution of node.exe and other scripting engines in unexpected contexts. 3. Conduct regular user awareness training focused on the risks of executing unknown utilities and browser extensions, emphasizing the deceptive nature of this malware family. 4. Monitor network traffic for connections to known malicious domains such as onestart.io, securebrowser.io, and 7df4va.com, and block these at perimeter firewalls and DNS layers. 5. Employ behavioral analytics to detect unusual installation patterns or persistence mechanisms, especially those involving desktop assistants or browser extensions. 6. Regularly audit installed software and browser extensions to identify and remove suspicious or unauthorized applications. 7. Maintain up-to-date threat intelligence feeds to quickly identify new hashes and indicators of compromise related to this malware. 8. Restrict use of PowerShell and node.js execution to only trusted scripts and signed code where possible, and enable logging and monitoring of script execution. 9. Implement multi-factor authentication and least privilege principles to limit the impact of potential compromises. 10. Prepare incident response plans that include procedures for detecting and eradicating malware that uses living-off-the-land techniques.

Indicators of compromise

Domains 4

7df4va.com
onestart.io
securebrowser.io
www.7df4va.com

Hashes 12

c9e85b19c02828f4992c79f6de18e929
e159d860d0cfa59816c686e4a9914113
484539b10b659fb4ab48e79bb0de0d0879153426
6a31d1cdbdca9fa951fff2ffd5dc3d52d45102bd
1ff8268fa64c8f55eb750c4433c1e9e47dc7359b7fcc653215423ed3fe5d8b4d
44ad9111f14c83be400bba303df5dc54ab699bb4f6e8144d052ac19812cd4fac
6b6fc62a294d5ef1c619d623f1cf6d735d9f191df9ef5c745b0881b1e01b8565
77e4dab34cb6c2169c47463b4ed81efe61185446c304b392dd9b0cbe2b31c67c
7ad613dee75da11ef9b7a92823bda3e290491e245956f5a192a3207a5f11d9a0
90b2e64ce4c6b2a0048158755281466b60b83ac1a8b43bb28614ec67c9fe52eb

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Sep 2025, 17:03 UTC

MITRE ATT&CK techniques8 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 12

Community reviews

Related threats