EtherRAT, PRISMEX, and ValleyRAT: Multi-Front APT Campaign Analysis — Node.js Backdoors & Steganography Detection Pack

---
title: Potential PRISMEX C2 Traffic - APT28
id: 48f736ea-c2a0-4826-8c5b-b1a9d2f3e4a5
description: Detects network connections to known PRISMEX malware C2 infrastructure abusing Filen.io cloud services observed in OTX pulses.
status: experimental
date: 2026/04/29
author: Security Arsenal Research
references:
    - https://www.trendmicro.com/en_us/research/26/c/pawn-storm-targets-govt-infra.html
tags:
    - attack.command_and_control
    - attack.t1071.001
logsource:
    category: network_connection
product: windows
detection:
    selection:
        DestinationHostname|contains:
            - 'filen.io'
            - 'filen-1.net'
            - 'filen-2.net'
    condition: selection
falsepositives:
    - Legitimate use of Filen.io cloud storage
level: high
---
title: Silver Fox ValleyRAT Malware File Detection
id: a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d
description: Detects the presence of ValleyRAT file hashes associated with the Silver Fox campaign targeting Japanese firms.
status: experimental
date: 2026/04/29
author: Security Arsenal Research
references:
    - https://www.welivesecurity.com/en/business-security/cunning-predator-how-silver-fox-preys-japanese-firms-tax-season/
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: file_event
product: windows
detection:
    selection:
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
            - '.doc'
            - '.xls'
        Hashes|contains:
            - '244a2f4dc256f6d1c3710a2d27656a6bc21ffadca8f3236d63b327ff2f0b33db'
            - '8c4386cecc89f5f2dee323f2a1e0d9f42a28905be812de14173ca7ee9fc64e72'
            - '55b99f0d438800cad8288d81d2808728ce1bec8c22c5346a38a513dc6728b4ba'
    condition: selection
falsepositives:
    - None
level: critical
---
title: Suspicious Node.js Process - EtherRAT Potential
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
description: Detects Node.js processes spawning command shells, a behavior indicative of the Node.js-based EtherRAT backdoor.
status: experimental
date: 2026/04/29
author: Security Arsenal Research
references:
    - https://www.esentire.com/blog/etherrat-sys-info-module-c2-on-ethereum-etherhiding-target-selection-cdn-like-beacons
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
product: windows
detection:
    selection:
        ParentImage|endswith: '\node.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
    condition: selection
falsepositives:
    - Legitimate development tools
level: medium

// Hunt for PRISMEX and EtherRAT Network IOCs
// Focus on Filen.io (PRISMEX) and suspicious domains (EtherRAT)
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has "filen.io" 
   or RemoteUrl has "payload.de"
   or RemoteUrl has "o-parana.com"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend FullURL = RemoteUrl

// Hunt for Silver Fox (ValleyRAT) File Hashes
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in (
    "244a2f4dc256f6d1c3710a2d27656a6bc21ffadca8f3236d63b327ff2f0b33db", 
    "8c4386cecc89f5f2dee323f2a1e0d9f42a28905be812de14173ca7ee9fc64e72",
    "55b99f0d438800cad8288d81d2808728ce1bec8c22c5346a38a513dc6728b4ba"
)
| project Timestamp, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessAccountName

# Silver Fox / ValleyRAT IOC Hunter
# Scans common user directories and temp folders for specific file hashes

$TargetHashes = @(
    "244a2f4dc256f6d1c3710a2d27656a6bc21ffadca8f3236d63b327ff2f0b33db",
    "8c4386cecc89f5f2dee323f2a1e0d9f42a28905be812de14173ca7ee9fc64e72",
    "55b99f0d438800cad8288d81d2808728ce1bec8c22c5346a38a513dc6728b4ba",
    "1af5b25acd2df31f44a54fc8dcd85287",
    "12a0d942652609bce7319be6bf0135bb",
    "21d9a30074d65babfef9e9e9684c6f5a",
    "4f481a449ad050fea9ca3900118e5676"
)

Write-Host "[+] Initiating Silver Fox (ValleyRAT) IOC Scan..." -ForegroundColor Cyan

# Define search paths (User profiles and temp)
$PathsToScan = @(
    "$env:USERPROFILE\Downloads",
    "$env:USERPROFILE\Documents",
    "$env:PUBLIC\Documents",
    "$env:TEMP"
)

foreach ($Path in $PathsToScan) {
    if (Test-Path $Path) {
        Write-Host "[+] Scanning $Path..." -ForegroundColor Yellow
        
        Get-ChildItem -Path $Path -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $File = $_
            try {
                $Hash = (Get-FileHash -Path $File.FullName -Algorithm SHA256 -ErrorAction Stop).Hash
                if ($TargetHashes -contains $Hash) {
                    Write-Host "[!] MALICIOUS FILE DETECTED: $($File.FullName)" -ForegroundColor Red
                    Write-Host "    Hash: $Hash" -ForegroundColor DarkRed
                }
            } catch {
                # Ignore errors (e.g., locked files)
            }
        }
    }
}

Write-Host "[+] Scan Complete." -ForegroundColor Green