ValleyRAT & Injective SDK Supply Chain: OTX Pulse Analysis — Credential Theft Campaign

title: Suspicious Network Connection to ValleyRAT C2 Infrastructure
id: 8a9b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
description: Detects network connections to known C2 infrastructure associated with the Indonesian Banking Sector threat landscape.
status: experimental
date: 2026/07/10
author: Security Arsenal
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp:
            - '188.127.251.171'
            - '59.110.7.32'
        DestinationHostname:
            - 'emezonhe.me'
            - 'skycloudcenter.com'
            - 'dog3rj.tech'
            - 'q74vn.live'
    condition: selection
falsepositives:
    - Unknown
level: critical
tags:
    - attack.command_and_control
    - attack.t1071
---
title: Malicious Injective SDK File Creation
id: 1c2d3e4f-5a6b-7c8d-9e0f-1a2b3c4d5e6f
description: Detects the creation of files matching the SHA256 hashes of the compromised Injective SDK npm package.
status: experimental
date: 2026/07/10
author: Security Arsenal
logsource:
    category: file_event
    product: windows
detection:
    selection_hash:
        TargetFilename|contains: 'node_modules'
        Hashes|contains:
            - '103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0'
            - '9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9'
    condition: selection_hash
falsepositives:
    - Legitimate npm package installation (verify version)
level: high
tags:
    - attack.initial_access
    - attack.t1195
---
title: Potential ValleyRAT Loader Execution via PowerShell
id: 3e4f5a6b-7c8d-9e0f-1a2b-3c4d5e6f7a8b
description: Detects patterns consistent with ValleyRAT droppers, typically involving PowerShell downloading payloads from suspicious TLDs or executing encoded commands leading to specific loader binaries.
status: experimental
date: 2026/07/10
author: Security Arsenal
logsource:
    category: process_creation
    product: windows
detection:
    selection_pwsh:
        ParentImage|endswith: '\powershell.exe'
        Image|endswith: ".exe"
        CommandLine|contains:
            - "-encodedcommand"
            - "DownloadString"
    selection_network:
        DestinationHostname|endswith:
            - '.me'
            - '.tech'
            - '.live'
    condition: 1 of selection*
falsepositives:
    - Administrative scripting
level: medium
tags:
    - attack.execution
    - attack.t1059.001

// Hunt for connections to known malicious infrastructure
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl in ("emezonhe.me", "skycloudcenter.com", "dog3rj.tech", "q74vn.live", "testnet.archival.chain.grpc-web.injective.network") 
   or RemoteIP in ("188.127.251.171", "59.110.7.32")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| extend IOCSource = "OTX-Pulse-IndonesiaBanking"

// Hunt for file hashes associated with the campaigns
DeviceFileEvents
| where Timestamp > ago(7d)
| where SHA256 in ("4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a", "103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0", "9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9")
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| extend IOCSource = "OTX-Pulse-Infostealer"

# IOC Hunt Script for ValleyRAT and Injective SDK Artifacts
# Run with Administrative Privileges

$IOC_Hashes = @(
    "4741c2884d1ca3a40dadd3f3f61cb95a59b11f99a0f980dbadc663b85eb77a2a",
    "103c4e6181151c1bcfedc41506cd1815458c38375d08a8fcd9981dbe0b965ce0",
    "9a59eb454f3ca3fe91214136ee5edd417cc47a80e6f169b52099d6561944baf9"
)

Write-Host "[+] Scanning for malicious file hashes..." -ForegroundColor Cyan

# Scan C: drive (adjust as needed)
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | 
    Where-Object { $_.Length -gt 0 } | 
    ForEach-Object {
        $fileHash = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($IOC_Hashes -contains $fileHash) {
            Write-Host "[!] MALICIOUS FILE FOUND: $($_.FullName)" -ForegroundColor Red
            Write-Host "    Hash: $fileHash" -ForegroundColor Red
        }
    }

Write-Host "[+] Checking network connections for C2 infrastructure..." -ForegroundColor Cyan

$C2_Domains = @("emezonhe.me", "skycloudcenter.com", "dog3rj.tech", "q74vn.live")
$C2_IPs = @("188.127.251.171", "59.110.7.32")

$connections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue

foreach ($conn in $connections) {
    $process = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
    $remoteAddr = $conn.RemoteAddress
    
    # Resolve IP to Hostname if necessary, simplified check here for IPs
    if ($C2_IPs -contains $remoteAddr) {
        Write-Host "[!] SUSPICIOUS CONNECTION: Remote IP $remoteAddr connected by $($process.ProcessName) (PID: $($conn.OwningProcess))" -ForegroundColor Red
    }
}

Write-Host "[+] Hunt complete." -ForegroundColor Green