SilverFox, Amaranth-Dragon & Lotus Blossom Converge on Indonesian BFSI: ValleyRAT, Amaranth Loader & Havoc C2 Detection Pack

---
title: WinRAR CVE-2025-8088 Exploitation - Startup Folder Payload Drop
id: 9f3a7c1e-2b4d-4e8a-91c2-otx8088a001
status: experimental
description: Detects archive extraction or process execution writing executables/scripts to user Startup folder, consistent with CVE-2025-8088 weaponized archive lures used by Mustang Panda / SilverFox clusters in the Indonesian BFSI campaign.
author: Security Arsenal Threat Intel
date: 2026/08/08
references:
    - https://www.cyfirma.com/research/indonesian-banking-sector-threat-landscape/
logsource:
    category: file_event
    product: windows
detection:
    selection_startup:
        TargetFilename|contains:
            - '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\'
    selection_ext:
        TargetFilename|endswith:
            - '.exe'
            - '.dll'
            - '.bat'
            - '.cmd'
            - '.ps1'
            - '.lnk'
    filter_known:
        Image|contains:
            - '\Microsoft\Office\'
    condition: selection_startup and selection_ext and not filter_known
fields:
    - Image
    - TargetFilename
    - User
tags:
    - attack.initial_access
    - attack.persistence
    - attack.t1547.001
    - cve.2025-8088
falsepositives:
    - Legitimate software installers adding autostart entries
level: high
---
title: Havoc or ValleyRAT C2 Beacon to Disposable Low-Reputation Domains
id: 9f3a7c1e-2b4d-4e8a-91c2-otx8088b002
status: experimental
description: Detects outbound DNS or network connections to known C2 domains from the Indonesian BFSI threat landscape pulse, associated with ValleyRAT, Havoc, and Amaranth Loader infrastructure.
author: Security Arsenal Threat Intel
date: 2026/08/08
references:
    - https://www.cyfirma.com/research/indonesian-banking-sector-threat-landscape/
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'emezonhe.me'
            - 'skycloudcenter.com'
            - 'dog3rj.tech'
            - 'q74vn.live'
            - 'abwxjp5.me'
            - 'servgate.me'
    condition: selection
fields:
    - query
    - Image
    - Computer
tags:
    - attack.command_and_control
    - attack.t1071.001
falsepositives:
    - Threat intelligence sandbox or researcher lookups
level: critical
---
title: Suspicious Scheduled Task or Run Key Persistence by Unsigned Loader Binary
id: 9f3a7c1e-2b4d-4e8a-91c2-otx8088c003
status: experimental
description: Detects creation of scheduled tasks or registry Run key entries pointing to binaries in user-writable paths, matching ValleyRAT, LOTUSLITE, and Amaranth Loader persistence tradecraft against BFSI targets.
author: Security Arsenal Threat Intel
date: 2026/08/08
references:
    - https://www.cyfirma.com/research/indonesian-banking-sector-threat-landscape/
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_path:
        Details|contains:
            - '\AppData\Local\Temp\'
            - '\AppData\Roaming\'
            - '\ProgramData\'
            - '\Users\Public\'
    condition: selection_key and selection_path
fields:
    - TargetObject
    - Details
    - Image
    - User
tags:
    - attack.persistence
    - attack.t1060
    - attack.t1547.001
falsepositives:
    - Legitimate per-user application updaters (Zoom, Teams)
level: medium

// Hunt for C2 beacons, loader execution, and CVE-2025-8088 exploitation artifacts
// associated with the Indonesian BFSI campaign (ValleyRAT / Havoc / Amaranth Loader)
let c2_domains = dynamic(["emezonhe.me","skycloudcenter.com","dog3rj.tech","q74vn.live","abwxjp5.me","servgate.me"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl has_any (c2_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort;
let DnsHits = DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType == "DnsQueryResponse"
| where AdditionalFields has_any (c2_domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, AdditionalFields;
let StartupDrop = DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FolderPath has @"Start Menu\Programs\Startup"
| where FileName endswith ".exe" or FileName endswith ".lnk" or FileName endswith ".bat"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256;
let KnownHash = DeviceFileEvents
| where TimeGenerated > ago(30d)
| where SHA256 == "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName;
union NetworkHits, DnsHits, StartupDrop, KnownHash
| sort by TimeGenerated desc

<#
.SYNOPSIS
  OTX IOC Hunt - Indonesian BFSI Campaign (ValleyRAT / Amaranth Loader / Havoc)
  Checks for known C2 DNS cache entries, malicious hash, Startup folder drops,
  and suspicious Run-key persistence. Run elevated across fleet via RMM/Intune.
#>

$IoCDomains = @("emezonhe.me","skycloudcenter.com","dog3rj.tech","q74vn.live","abwxjp5.me","servgate.me")
$IoCHash    = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a"
$findings   = @()

# 1. DNS cache check for C2 resolution
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $IoCDomains) {
    $hits = $dnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hits) { $findings += "[ALERT] DNS cache hit for C2 domain: $d" }
}

# 2. Active/recent connections to C2 infrastructure (netstat + DNS reverse)
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $ptr = (Resolve-DnsName $_.RemoteAddress -Type PTR -ErrorAction Stop).NameHost
        foreach ($d in $IoCDomains) {
            if ($ptr -like "*$d*") {
                $findings += "[ALERT] Active connection PID $($_.OwningProcess) -> $($_.RemoteAddress):$($_.RemotePort) [$ptr]"
            }
        }
    } catch {}
}

# 3. CVE-2025-8088 style Startup folder drops
$startupPaths = @(
    "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
    "$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)
foreach ($p in $startupPaths) {
    Get-ChildItem $p -ErrorAction SilentlyContinue | Where-Object {
        $_.Extension -in '.exe','.dll','.bat','.cmd','.ps1','.lnk' -and $_.LastWriteTime -gt (Get-Date).AddDays(-30)
    } | ForEach-Object { $findings += "[REVIEW] Recent Startup artifact: $($_.FullName) ($($_.LastWriteTime))" }
}

# 4. Run-key persistence pointing at user-writable paths
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
             "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
    (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties | ForEach-Object {
        if ($_.Value -match 'AppData|ProgramData|Users\\Public|Temp') {
            $findings += "[REVIEW] Run key persistence: $k -> $($_.Name) = $($_.Value)"
        }
    }
}

# 5. Scheduled tasks executing from user-writable locations
Get-ScheduledTask | ForEach-Object {
    $action = $_.Actions.Execute
    if ($action -match 'AppData|Temp|Users\\Public') {
        $findings += "[REVIEW] Suspicious scheduled task: $($_.TaskName) -> $action"
    }
}

# 6. Hash sweep of common staging directories
foreach ($dir in @("$env:TEMP","$env:LOCALAPPDATA","$env:ProgramData")) {
    Get-ChildItem $dir -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue |
      Where-Object { $_.Length -lt 50MB } | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash -eq $IoCHash) {
            $findings += "[CRITICAL] Known malicious hash match: $($_.FullName)"
        }
    }
}

if ($findings) { $findings | ForEach-Object { Write-Host $_ -ForegroundColor Red } }
else { Write-Host "[CLEAN] No campaign IOC artifacts detected on $env:COMPUTERNAME" -ForegroundColor Green }