SilabRAT MaaS & AI-Themed Infostealer Operations: Storm-3075 & o1oo1 Analysis

---
title: Potential Hijack Loader Shellcode Execution
id: 9b08e3a4-5a3d-4b21-8f1c-6e7d8f9a0b1c
description: Detects process execution patterns often associated with Hijack Loader loading shellcode via control panel applets or rundll32.
status: experimental
date: 2026/06/10
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/666666666666
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\rundll32.exe'
            - '\\regsvr32.exe'
            - '\\control.exe'
        CommandLine|contains:
            - '.cpl'
            - '.dll'
    filter_legit:
        Signed: 'true'
        Publisher: 'Microsoft*'
    condition: selection and not filter_legit
falsepositives:
    - Legitimate system administration
level: high
---
title: SilabRAT Browser Profile Cloning Activity
id: c7d2e5f8-9a4b-4c3d-8e6f-1a2b3c4d5e6f
description: Detects non-browser processes accessing browser profile directories (User Data, Local Storage), a behavior indicative of SilabRAT and stealers.
status: experimental
date: 2026/06/10
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/666666666667
tags:
    - attack.credential_access
    - attack.t1005
logsource:
    category: file_access
    product: windows
detection:
    selection:
        TargetFilename|contains:
            - '\\Google\\Chrome\\User Data\\Default\\'
            - '\\Mozilla\\Firefox\\Profiles\\'
            - '\\BraveSoftware\\Brave-Browser\\User Data\\Default\\'
    filter_browser:
        Image|endswith:
            - '\\chrome.exe'
            - '\\firefox.exe'
            - '\\brave.exe'
            - '\\msedge.exe'
    condition: selection and not filter_browser
falsepositives:
    - Backup software
    - Legitimate browser sync utilities
level: high
---
title: AI-Themed Phishing Lure Execution
id: d1e2f3a4-5b6c-7d8e-9f0a-1b2c3d4e5f6a
description: Detects execution of suspicious processes with arguments containing AI branding (ChatGPT, Copilot, etc.) often used in Storm-3075 campaigns.
status: experimental
date: 2026/06/10
author: Security Arsenal
references:
    - https://otx.alienvault.com/pulse/666666666665
tags:
    - attack.initial_access
    - attack.t1566.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'ChatGPT'
            - 'DeepSeek'
            - 'Claude'
            - 'Copilot'
    filter_legit:
        Image|endswith:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\Code.exe' # VS Code referencing AI extensions
    condition: selection and not filter_legit
falsepositives:
    - Legitimate AI software installers
level: medium

// Hunt for network connections to known C2 infrastructure and suspicious domains
let IOCs = dynamic(["brokeapt.com", "rongtv.xyz", "ssffaa19.xyz", "91.199.163.124"]);
DeviceNetworkEvents
| where RemoteUrl has_any (IOCs) or RemoteIP in (IOCs)
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| order by Timestamp desc
// Hunt for file creation events matching known malware hashes
let MalwareHashes = dynamic([
    "4f5c5b3ef45cfff7721754487a86aeff9a2e6e32",
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b"
]);
DeviceFileEvents
| where SHA1 in (MalwareHashes) or SHA256 in (MalwareHashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| order by Timestamp desc

# Script to scan for SilabRAT and Stealer artifacts (File hashes and Processes)
# Requires Administrator Privileges

$TargetHashes = @(
    "0a26238f6c516de5885457c93042531aa59bc206a9537cebf5267cedc6c68531",
    "25270cc429ada8028b5b33220ed412c47907ecceea7377d608fac5af01bed56a",
    "5455341ed1bbe75a664fca2dd0794c508e1874f75360253a7ff5bc119bc92d80",
    "56d722b0331bf0aaa86bb37483486c6dff6ad9427fc473ed7c3226c21a9bdd23",
    "3a6adbe0081b2488e0f137496e92591e0c29148154b2d99faadab9cc435b879b",
    "79f8da9f9fb4ac7c16d9c210f1f6ef418357a3e7bf602b1dd03a490596fa58c5",
    "fb56e66920c84ef9e51db0ea23144f5755daef97cbff8613b05ab56d0dc9d623",
    "fbce30a0c852972fdc24f1b6a7c270512a50ef1a7c6c88c88b92a2dcbdfdd023"
)

Write-Host "[+] Scanning for known malicious file hashes..."

# Get all fixed drives
$Drives = Get-PSDrive -PSProvider FileSystem | Where-Object { $_.Used -gt 0 }

foreach ($Drive in $Drives) {
    Write-Host "[*] Scanning drive $($Drive.Root)..."
    try {
        # Scan recursively, limit depth to 3 for performance in hunt scenario
        Get-ChildItem -Path $Drive.Root -Recurse -ErrorAction SilentlyContinue | 
            Get-FileHash -Algorithm SHA256 -ErrorAction SilentlyContinue | 
            Where-Object { $TargetHashes -contains $_.Hash } | 
            ForEach-Object {
                Write-Host "[!] MALICIOUS FILE FOUND: $($_.Path) | Hash: $($_.Hash)" -ForegroundColor Red
            }
    } catch {
        # Ignore access errors
    }
}

Write-Host "[+] Checking for suspicious network connections to SilabRAT C2 IP..."
$C2IP = "91.199.163.124"
$Connections = Get-NetTCPConnection -RemoteAddress $C2IP -ErrorAction SilentlyContinue
if ($Connections) {
    Write-Host "[!] ACTIVE CONNECTION TO C2 DETECTED!" -ForegroundColor Red
    $Connections | Format-Table LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess
} else {
    Write-Host "[-] No active connections to known C2 IP found."
}