MioLab Stealer, GhostSocks Proxy Botnet, and Trigona Exfil Tool: OTX Pulse Analysis — Enterprise Detection Pack

title: Potential MioLab Stealer C2 Connection
id: 8a1b2c3d-4e5f-6789-0123-456789abcdef
description: Detects network connections to known MioLab Stealer C2 infrastructure domains.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6635a7b2c422830e00b3e1d0
tags:
    - attack.credential_access
    - attack.exfiltration
logsource:
    category: network_connection
    product: macos
detection:
    selection:
        destination|contains:
            - 'mioisiskwowiwjowuwjwolab.club'
            - 'officerelaxation.com'
            - 'approve-me.com'
            - 'marinemember.com'
    condition: selection
falsepositives:
    - Unknown
level: high
---
title: GhostSocks Proxy Activity
id: 9b2c3d4e-5f6a-7890-1234-567890abcdef
description: Detects processes initiating connections to known GhostSocks infrastructure or suspicious high-volume proxy ports.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6635a7b2c422830e00b3e1d1
tags:
    - attack.command_and_control
    - attack.defense_evasion
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        destination|contains:
            - 'retreaw.click'
            - 'bruggebogeyed.site'
    selection_proxy:
        destination.port in range:
            - 1080
            - 1081
            - 1082
    condition: 1 of selection_*
falsepositives:
    - Legitimate SOCKS proxy usage
level: medium
---
title: Trigona Custom Exfiltration Tool Execution
id: 0c3d4e5f-6a7b-8901-2345-678901bcdefg
description: Detects execution of the custom uploader_client.exe used by Trigona affiliates.
status: experimental
date: 2026/05/04
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/6635a7b2c422830e00b3e1d2
tags:
    - attack.exfiltration
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\uploader_client.exe'
        Hashes|contains:
            - 'e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173'
            - '816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019'
    condition: selection
falsepositives:
    - Legitimate internal uploader tool (verify hash)
level: critical

// Hunt for Trigona Custom Uploader and GhostSocks Domains
let TrigonaHashes = dynamic(["e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173", "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019"]);
let GhostSocksDomains = dynamic(["retreaw.click", "bruggebogeyed.site"]);
let MioLabDomains = dynamic(["mioisiskwowiwjowuwjwolab.club", "officerelaxation.com", "approve-me.com"]);
// 1. Process Creation for Trigona Tool
DeviceProcessEvents
| where InitiatingProcessFileName =~ "uploader_client.exe" or SHA256 in TrigonaHashes
| project Timestamp, DeviceName, FileName, ProcessCommandLine, SHA256
| union (
    // 2. Network Connections to GhostSocks
    DeviceNetworkEvents
    | where RemoteUrl has_any (GhostSocksDomains) or RemoteUrl has_any (MioLabDomains)
    | project Timestamp, DeviceName, RemoteUrl, RemoteIP, RemotePort, InitiatingProcessFileName
)

<#
.SYNOPSIS
    Hunt script for Trigona Uploader and MioLab/GhostSocks Indicators.
.DESCRIPTION
    Checks processes and DNS cache for known IOCs from the OTX Pulse.
#>

$TrigonaHashes = @(
    "e8a3e804a96c716a3e9b69195db6ffb0d33e2433af871e4d4e1eab3097237173",
    "816d7616238958dfe0bb811a063eb3102efd82eff14408f5cab4cb5258bfd019"
)

$MaliciousDomains = @(
    "mioisiskwowiwjowuwjwolab.club",
    "officerelaxation.com",
    "approve-me.com",
    "retreaw.click",
    "bruggebogeyed.site"
)

Write-Host "[+] Hunting for Trigona uploader_client.exe processes..." -ForegroundColor Cyan
$processes = Get-Process | Where-Object { $_.ProcessName -eq "uploader_client" }

if ($processes) {
    foreach ($proc in $processes) {
        Write-Host "[!] ALERT: Found uploader_client.exe running (PID: $($proc.Id))" -ForegroundColor Red
        try {
            $fileHash = (Get-FileHash -Path $proc.Path -Algorithm SHA256 -ErrorAction Stop).Hash
            if ($fileHash -in $TrigonaHashes) {
                Write-Host "[!!!] CRITICAL: Hash matches known Trigona Exfil Tool: $fileHash" -ForegroundColor Red
            }
        } catch {
            Write-Host "[-] Could not calculate hash for $($proc.Path)" -ForegroundColor DarkYellow
        }
    }
} else {
    Write-Host "[-] No uploader_client.exe processes found." -ForegroundColor Green
}

Write-Host "[+] Checking DNS Cache for malicious domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache | Where-Object { $MaliciousDomains -contains $_.Data }

if ($dnsCache) {
    Write-Host "[!] ALERT: Found malicious domain entries in DNS Cache:" -ForegroundColor Red
    $dnsCache | Format-Table Entry, Data, TimeToLive
} else {
    Write-Host "[-] No malicious domains found in local DNS cache." -ForegroundColor Green
}