SilverFox, Mustang Panda & Amaranth-Dragon Converge on Indonesian BFSI: ValleyRAT, LOTUSLITE, and Amaranth Loader Campaign Analysis — OTX Detection Pack

---
title: ValleyRAT / Amaranth Loader DLL Side-Loading Execution
id: 8f3a1c2e-4b7d-4e9a-b1c5-6d2f8a0e9c31
status: experimental
description: Detects DLL side-loading patterns associated with ValleyRAT, Amaranth Loader, and LOTUSLITE delivery - legitimate signed executables loading unsigned DLLs from user-writable directories
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/
    - https://www.cyfirma.com/research/indonesian-banking-sector-threat-landscape/
date: 2026/08/08
tags:
    - attack.defense_evasion
    - attack.t1574.002
    - attack.execution
logsource:
    category: image_load
    product: windows
    definition: sysmon
detection:
    selection_unsigned_dll:
        Signed: 'false'
        ImageLoaded|contains:
            - '\AppData\Roaming\'
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
            - '\Users\Public\'
    selection_signed_host:
        Image|contains:
            - '\Program Files\'
            - '\Windows\System32\'
        SignatureStatus: 'Valid'
    filter_legit:
        ImageLoaded|contains:
            - '\Microsoft\'
    condition: selection_unsigned_dll and selection_signed_host and not filter_legit
falsepositives:
    - Legitimate software loading third-party plugins from ProgramData
level: high
---
title: APT C2 Communication to Indonesian BFSI Campaign Infrastructure
id: 2e7b9d4a-1c5f-4a8e-9d3b-7f1e4c6a8b52
status: experimental
description: Detects network connections or DNS queries to known C2 domains used by SilverFox, Mustang Panda, Amaranth-Dragon and Lotus Blossom clusters targeting Indonesian BFSI sector
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/
date: 2026/08/08
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1568
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'emezonhe.me'
            - 'skycloudcenter.com'
            - 'dog3rj.tech'
            - 'q74vn.live'
            - 'abwxjp5.me'
            - 'servgate.me'
    condition: selection
falsepositives:
    - Unlikely; these domains have no legitimate business purpose
level: critical
---
title: RAT Persistence via Scheduled Task or Run Key - SilverFox / Amaranth Pattern
id: 5c1a8f3d-9e2b-4d6c-a7f4-3b9e1d5c7a64
status: experimental
description: Detects persistence establishment through scheduled tasks or registry Run keys launching payloads from user-writable paths, consistent with ValleyRAT and TGAmaranth RAT persistence mechanisms
author: Security Arsenal Threat Intelligence
references:
    - https://otx.alienvault.com/pulse/
date: 2026/08/08
tags:
    - attack.persistence
    - attack.t1053.005
    - attack.t1547.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains|all:
            - '/create'
        CommandLine|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Users\Public\'
    selection_reg:
        Image|endswith: '\reg.exe'
        CommandLine|contains:
            - '\CurrentVersion\Run'
            - 'add'
        CommandLine|contains:
            - '\AppData\'
            - '\ProgramData\'
            - '\Temp\'
    condition: 1 of selection_*
falsepositives:
    - Software installers creating update tasks; whitelist known enterprise applications
level: high

// Hunt: Indonesian BFSI APT campaign - C2 beacons, loader execution, and persistence artifacts
let C2Domains = dynamic(["emezonhe.me","skycloudcenter.com","dog3rj.tech","q74vn.live","abwxjp5.me","servgate.me"]);
let CampaignHash = "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a";
let Lookback = 30d;
// Part 1: Network beaconing to known C2 infrastructure
let C2Traffic = DeviceNetworkEvents
| where TimeGenerated > ago(Lookback)
| where RemoteUrl has_any (C2Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| extend DetectionType = "C2 Beacon";
// Part 2: Payload hash observed on any endpoint
let HashHits = union (DeviceFileEvents | where TimeGenerated > ago(Lookback) | where SHA256 == CampaignHash | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256 | extend DetectionType="Payload File"),
(DeviceProcessEvents | where TimeGenerated > ago(Lookback) | where SHA256 == CampaignHash | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256 | extend DetectionType="Payload Execution");
// Part 3: Persistence creation from user-writable paths (ValleyRAT / Amaranth pattern)
let Persistence = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where (FileName =~ "schtasks.exe" and ProcessCommandLine has_all ("/create") and ProcessCommandLine has_any ("AppData","ProgramData","Public"))
     or (FileName =~ "reg.exe" and ProcessCommandLine has "CurrentVersion\\Run" and ProcessCommandLine has_any ("AppData","ProgramData","Temp"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend DetectionType = "Persistence Attempt";
// Part 4: Rundll32/regsvr32 execution from suspicious paths (DLL side-loading follow-on)
let SideLoad = DeviceProcessEvents
| where TimeGenerated > ago(Lookback)
| where FileName in~ ("rundll32.exe","regsvr32.exe")
| where ProcessCommandLine has_any ("AppData","ProgramData","Users\\Public","Temp")
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","wscript.exe","mshta.exe","powershell.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName
| extend DetectionType = "Side-Load Execution";
union C2Traffic, HashHits, Persistence, SideLoad
| sort by TimeGenerated desc

# Security Arsenal - Indonesian BFSI APT Campaign Endpoint Hunt
# Hunts ValleyRAT / LOTUSLITE / Amaranth Loader artifacts: C2 DNS, persistence, payload hash
param([switch]$Verbose)

$C2Domains = @('emezonhe.me','skycloudcenter.com','dog3rj.tech','q74vn.live','abwxjp5.me','servgate.me')
$TargetHash = '4741C2884D1CA3A40DADD3F3F61CB95A59B11F99A0F980DBADC663B85EB77A2A'
$Findings = @()

Write-Host "[+] Checking DNS client cache for campaign C2 domains..." -ForegroundColor Cyan
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $d = $_.Entry; $C2Domains | Where-Object { $d -like "*$_*" } }
if ($dns) { $dns | ForEach-Object { $Findings += [pscustomobject]@{Type='DNS Cache'; Detail="$($_.Entry) -> $($_.Data)"} } }

Write-Host "[+] Checking netstat for live connections..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    $r = $_.RemoteAddress
    foreach ($dom in $C2Domains) {
        try { $resolved = (Resolve-DnsName $dom -Type A -ErrorAction Stop).IPAddress
              if ($resolved -contains $r) { $Findings += [pscustomobject]@{Type='Live C2 Connection'; Detail="$dom -> $r`:$($_.RemotePort) PID $($_.OwningProcess)"} } } catch {}
    }
}

Write-Host "[+] Checking Run keys for user-writable path persistence..." -ForegroundColor Cyan
$runKeys = @('HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $runKeys) {
    Get-ItemProperty $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|ProgramData|Users\\Public|Temp' } | ForEach-Object {
            $Findings += [pscustomobject]@{Type='Run Key Persistence'; Detail="$key :: $($_.Name) = $($_.Value)"}
        }
    }
}

Write-Host "[+] Checking scheduled tasks launching from suspicious paths..." -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    ($_.Actions.Execute -match 'AppData|ProgramData|Users\\Public') -and ($_.TaskPath -notlike '*Microsoft*')
} | ForEach-Object { $Findings += [pscustomobject]@{Type='Scheduled Task Persistence'; Detail="$($_.TaskName) -> $($_.Actions.Execute)"} }

Write-Host "[+] Hash-scanning user-writable directories for campaign payload..." -ForegroundColor Cyan
$paths = @("$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\ProgramData","C:\Users\Public")
foreach ($p in $paths) {
    Get-ChildItem $p -Recurse -File -Include *.exe,*.dll -ErrorAction SilentlyContinue | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash -eq $TargetHash) {
            $Findings += [pscustomobject]@{Type='Payload Hash Match'; Detail=$_.FullName}
        }
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "`n[!] $($Findings.Count) FINDING(S) - isolate host and escalate to IR:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
    $Findings | Export-Csv ".\BFSI_APT_Hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
} else { Write-Host "`n[OK] No campaign artifacts detected on this host." -ForegroundColor Green }