Dolphin X Stealer & Kontraktnik AI-Driven Infostealer Campaign — Enterprise Detection Pack

title: Potential Dolphin X Stealer C2 Communication
id: 8a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects network connections to known Dolphin X C2 infrastructure domains used by Kontraktnik.
status: experimental
date: 2026/07/23
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6example-pulse-id/
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'thedolphinx.top'
            - 'backend.thedolphinx.top'
    condition: selection
falsepositives:
    - Unknown
level: critical

---

title: Suspicious Access to DevOps Secrets Files
id: 9d2e3f4a-5b6c-7d8e-9f0a-1b2c3d4e5f6a
description: Detects processes accessing sensitive DevOps files like .env or SSH keys, indicative of infostealer activity like Dolphin X.
status: experimental
date: 2026/07/23
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6example-pulse-id/
tags:
    - attack.credential_access
    - attack.t1552.001
logsource:
    category: file_access
product: windows
detection:
    selection:
        TargetFilename|contains:
            - '.env'
            - 'id_rsa'
            - 'id_ed25519'
            - 'aws/credentials'
    filter_legit:
        Image|contains:
            - '\Program Files\'
            - '\Windows\'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate developer tools accessing config files
level: high

---

title: Dolphin X Payload Execution
id: 0e1f2a3b-4c5d-6e7f-8a9b-0c1d2e3f4a5b
description: Detects execution of the known Dolphin X stealer payload hash.
status: experimental
date: 2026/07/23
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6example-pulse-id/
tags:
    - attack.execution
    - attack.t1204
logsource:
    category: process_creation
product: windows
detection:
    selection:
        Hashes|contains: '726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0'
    condition: selection
falsepositives:
    - None
level: critical

// Hunt for network connections to Dolphin X C2
DeviceNetworkEvents
| where RemoteUrl has "thedolphinx.top" or RemoteUrl has "backend.thedolphinx.top"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemotePort

// Hunt for the specific file hash on endpoints
DeviceFileEvents
| where SHA256 == "726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessAccountName

# Dolphin X IOC Hunter
# Checks for the presence of the malicious file hash and C2 domain connections

$MaliciousHash = "726e7fe23560fe03ea36163d5f510b494f41a78bf811c92ff219f64b4bfe2be0"
$C2Domain = "thedolphinx.top"

Write-Host "[+] Scanning for Dolphin X IOCs..." -ForegroundColor Cyan

# Check file system for the hash (Requires Get-FileHash)
Write-Host "[*] Scanning C:\ drive for malicious hash (This may take time)..." -ForegroundColor Yellow
$Matches = Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { -not $_.PSIsContainer } | 
    ForEach-Object { 
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($hash -eq $MaliciousHash) { $_.FullName }
    }

if ($Matches) {
    Write-Host "[!] MALICIOUS FILE FOUND:" -ForegroundColor Red
    $Matches | ForEach-Object { Write-Host "    - $_" }
} else {
    Write-Host "[-] No files matching hash found." -ForegroundColor Green
}

# Check DNS Cache for C2 domains
Write-Host "[*] Checking DNS Cache for $C2Domain..." -ForegroundColor Yellow
$DnsEntries = Get-DnsClientCache | Where-Object { $_.Entry -like "*$C2Domain*" }

if ($DnsEntries) {
    Write-Host "[!] SUSPICIOUS DNS ENTRY FOUND:" -ForegroundColor Red
    $DnsEntries | Format-Table Entry, Data, Type
} else {
    Write-Host "[-] No DNS cache entries found." -ForegroundColor Green
}