PRISMEX, ValleyRAT & AMOS Stealer: OTX Pulse Analysis — Enterprise Detection Pack

---
title: PRISMEX Malware C2 Communication
id: 9b6c1d8b-7f8e-4a3d-9b1c-8d7e6a5b4c3a
description: Detects potential network communication with known PRISMEX C2 infrastructure based on provided hostnames.
author: Security Arsenal
date: 2026/04/29
modified: 2026/04/29
status: stable
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationHostname|contains:
      - 'filen.io'
      - 'filen-1.net'
      - 'filen-2.net'
      - 'filen-3.net'
      - 'filen-4.net'
      - 'filen-5.net'
  condition: selection
falsepositives:
  - Legitimate use of Filen cloud storage service (rare in targeted environments)
level: high
---
title: ValleyRAT Process Creation
id: a7d2e9f0-5c4b-4e1a-8a3d-7e6b9a5c4d3b
description: Detects the execution of a process with a command line indicative of ValleyRAT activity, based on observed campaign hashes.
author: Security Arsenal
date: 2026/04/29
modified: 2026/04/29
status: experimental
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_hashes:
    Hashes|contains:
      - '1af5b25acd2df31f44a54fc8dcd85287'
      - '244a2f4dc256f6d1c3710a2d27656a6bc21ffadca8f3236d63b327ff2f0b33db'
      - '8c4386cecc89f5f2dee323f2a1e0d9f42a28905be812de14173ca7ee9fc64e72'
      - '55b99f0d438800cad8288d81d2808728ce1bec8c22c5346a38a513dc6728b4ba'
      - '12a0d942652609bce7319be6bf0135bb'
      - '21d9a30074d65babfef9e9e9684c6f5a'
      - '4f481a449ad050fea9ca3900118e5676'
  selection_parent:
    ParentImage|endswith:
      - '\\explorer.exe'
      - '\\winword.exe'
      - '\\\\excel.exe'
  condition: all of selection*
falsepositives:
  - Rare, unless a legitimate binary has the same hash (impossible)
level: critical
---
title: AMOS Stealer Suspicious macOS Script Execution
id: 1e3f4a5b-6d7c-8e9a-0b1c-2d3e4f5a6b7c
description: Detects the execution of osascript with arguments consistent with the AMOS Stealer loader delivered via Cursor AI.
author: Security Arsenal
date: 2026/04/29
modified: 2026/04/29
status: experimental
tags:
  - attack.execution
  - attack.t1059.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/osascript'
    CommandLine|contains:
      - '-e'
      - 'tell application'
  selection_network:
    DestinationHostname|contains:
      - 'mpasvw.com'
      - 'arkypc.com'
  condition: 1 of selection*
falsepositives:
  - Legitimate use of osascript by users or admins
level: medium

// Hunt for PRISMEX C2 traffic
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("filen.io", "filen-1.net", "filen-2.net", "filen-3.net", "filen-4.net", "filen-5.net")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend FullUrl = RemoteUrl
| summarize count() by DeviceName, FullUrl, RemoteIP
| order by count_ desc


kql
// Hunt for AMOS Stealer loader file creation
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 has_any ("244a2f4dc256f6d1c3710a2d27656a6bc21ffadca8f3236d63b327ff2f0b33db", "8c4386cecc89f5f2dee323f2a1e0d9f42a28905be812de14173ca7ee9fc64e72") or FileName =~ "*.applescript" or FileName =~ "*.scpt"
| project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, FolderPath, SHA256
| order by Timestamp desc

<#
.SYNOPSIS
    Hunt script for AMOS Stealer artifacts on macOS endpoints.
.DESCRIPTION
    This script checks for known file hashes, suspicious filenames, and network connections associated with the AMOS Stealer campaign.
#>

$KnownHashes = @(
    "312147c0ae0d555a4d50fa627ff7d4f3",
    "c54620dd3745fdeaff5ccc0db4132f11"
)

$SuspiciousDomains = @(
    "mpasvw.com",
    "arkypc.com"
)

# Check for files with known hashes
Write-Host "Hunting for files with known AMOS Stealer hashes..."
Get-ChildItem -Path / -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.Length -gt 0 -and $KnownHashes -contains (Get-FileHash -Path $_.FullName -Algorithm MD5).Hash } | ForEach-Object { Write-Host "Suspicious file found: $($_.FullName)" }

# Check for suspicious network connections (requires lsof)
Write-Host "Hunting for network connections to suspicious domains..."
foreach ($domain in $SuspiciousDomains) {
    $connections = lsof -i :80,443 -n | Select-String $domain
    if ($connections) {
        Write-Host "Suspicious connection to $domain found:"
        $connections | ForEach-Object { Write-Host $_ }
    }
}