PRISMEX, ValleyRAT, and AMOS Stealer: OTX Pulse Analysis — APT Espionage, Targeted Tax Fraud, and AI-Agent Exploitation

---
title: Potential PRISMEX C2 Connection
id: 6d9a1234-5678-90ab-cdef-1234567890ab
status: experimental
description: Detects potential network connections to PRISMEX C2 infrastructure (Filen.io domains) as reported in OTX Pulse.
author: Security Arsenal
date: 2026/04/30
references:
    - https://otx.alienvault.com/pulse/662fa6d91e1e4c5c7f8e9b0a
logsource:
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:
            - 'filen.io'
            - 'egest.filen.io'
    condition: selection
falsepositives:
    - Legitimate use of Filen.io cloud storage (rare in targeted enterprise environments)
level: high
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Suspicious AppleScript Execution via Cursor AI
id: 1a2b3c4d-5e6f-7890-1234-567890abcdef
status: experimental
description: Detects execution of obfuscated AppleScript potentially related to AMOS Stealer delivery via Cursor AI sessions.
author: Security Arsenal
date: 2026/04/30
references:
    - https://otx.alienvault.com/pulse/662fa6d91e1e4c5c7f8e9b0c
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/osascript'
        CommandLine|contains:
            - 'curl'
            - 'http://arkypc.com'
            - 'http://mpasvw.com'
    condition: selection
falsepositives:
    - Legitimate administrative scripting
level: critical
tags:
    - attack.execution
    - attack.t1059.002
---
title: PRISMEX Persistence via COM Hijacking
id: abcdef01-2345-6789-abcd-ef0123456789
status: experimental
description: Detects registry modifications indicative of COM Hijacking, a technique used by PRISMEX for persistence.
author: Security Arsenal
date: 2026/04/30
references:
    - https://otx.alienvault.com/pulse/662fa6d91e1e4c5c7f8e9b0a
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: 'Software\Classes\CLSID'
        TargetObject|contains: 'InprocServer32'
        Details|contains: '.dll'
    filter_legit:
        Image|endswith:
            - '\msiexec.exe'
            - '\svchost.exe'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate software installation
level: medium
tags:
    - attack.persistence
    - attack.t1546.015


kql
// Hunt for PRISMEX C2 Infrastructure
DeviceNetworkEvents
| where RemoteUrl has "filen.io" or RemoteUrl has "egest.filen.io"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| order by Timestamp desc
| extend HuntName = "PRISMEX C2 Traffic"
// Hunt for AMOS Stealer Domains
// union is used to hunt across multiple distinct campaigns
union (
    DeviceNetworkEvents
    | where RemoteUrl in ("arkypc.com", "mpasvw.com")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, InitiatingProcessCommandLine
    | extend HuntName = "AMOS Stealer C2 Traffic"
)
| order by Timestamp desc


powershell
# PowerShell Hunt Script for IOCs
# Checks for active connections to known C2 infrastructure and suspicious file hashes

$C2Domains = @("gateway.filen.io", "egest.filen.io", "arkypc.com", "mpasvw.com")
$MaliciousHashes = @(
    "244a2f4dc256f6d1c3710a2d27656a6bc21ffadca8f3236d63b327ff2f0b33db",
    "8c4386cecc89f5f2dee323f2a1e0d9f42a28905be812de14173ca7ee9fc64e72",
    "312147c0ae0d555a4d50fa627ff7d4f3"
)

Write-Host "Checking for active network connections to C2 domains..." -ForegroundColor Yellow
Get-NetTCPConnection | ForEach-Object {
    $process = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($process) {
        try {
            $remoteHost = [System.Net.Dns]::GetHostEntry($_.RemoteAddress).HostName
            if ($C2Domains -contains $remoteHost) {
                Write-Host "[ALERT] Connection to C2 Domain detected: $remoteHost (PID: $($process.Id))" -ForegroundColor Red
            }
        } catch {}
    }
}

Write-Host "`nScanning for malicious file hashes in User Temp and Downloads..." -ForegroundColor Yellow
$paths = @("$env:TEMP", "$env:USERPROFILE\Downloads")
foreach ($path in $paths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -File -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
            $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
            if ($MaliciousHashes -contains $hash) {
                Write-Host "[ALERT] Malicious file found: $($_.FullName)" -ForegroundColor Red
            }
        }
    }
}