ValleyRAT Overwolf Sideload + Operation QUICSILVER + ASTERIX Crypto Fraud Pipeline: OTX Pulse Analysis — Enterprise Detection Pack

---
title: Signed Overwolf Binary DLL Sideloading - ValleyRAT
id: 8f3d2c1a-4b7e-4e5a-9c1d-valleyrat001
status: experimental
description: Detects a signed Overwolf executable loading an unsigned or unsigned-path DLL consistent with the ValleyRAT taxation phishing campaign (DLL hijack + sideload).
author: Security Arsenal
logsource:
  category: image_load
  product: windows
detection:
  selection_parent:
    Image|endswith: '\Overwolf.exe'
  selection_dll_unsigned:
    Signed: 'false'
  selection_dll_path:
    ImageLoaded|contains:
      - '\AppData\'
      - '\Temp\'
      - '\Downloads\'
      - '\Users\Public\'
  condition: selection_parent and (selection_dll_unsigned or selection_dll_path)
falsepositives:
  - Legitimate Overwolf plugin loads from its installation directory
level: high
tags:
  - attack.defense_evasion
  - attack.t1574.002
  - attack.t1218
fields:
  - Image
  - ImageLoaded
  - Hashes
date: 2026/08/19
---
title: VHD Mount Followed by Suspicious Child Process - Operation QUICSILVER
id: 7a1b9e4d-2f5c-4a3b-8d6e-quicsilver01
status: experimental
description: Detects execution of binaries from a mounted VHD volume or Go-compiled payloads making outbound UDP/443 (QUIC) connections, consistent with QUICAgent delivered via VHD files masquerading as images.
author: Security Arsenal
logsource:
  category: process_creation
  product: windows
detection:
  selection_mount_artifact:
    CommandLine|contains:
      - '.vhd'
      - '.vhdx'
  selection_double_ext:
    CommandLine|re: '(?i)\.(jpeg|jpg|png)\.(vhd|vhdx)'
  selection_rundll:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\mshta.exe'
    CommandLine|contains:
      - ':\\'
      - 'Temp'
      - 'AppData'
  condition: selection_double_ext or (selection_mount_artifact and selection_rundll)
falsepositives:
  - IT administrators mounting VHD backups
level: high
tags:
  - attack.initial_access
  - attack.t1204.002
  - attack.defense_evasion
date: 2026/08/19
---
title: Fake Crypto Wallet Electron App Seed Phrase Exfiltration via Telegram
id: 4c8e1f2b-9a6d-4b7c-3e5f-asterix0001
status: experimental
description: Detects Electron-based fake wallet applications (Ledger/Trezor/Exodus clones) initiating connections to the Telegram Bot API for seed phrase exfiltration, as observed in Operation ASTERIX.
author: Security Arsenal
logsource:
  category: network_connection
  product: windows
detection:
  selection_telegram:
    DestinationHostname|contains:
      - 'api.telegram.org'
    DestinationPort: 443
  selection_wallet_proc:
    Image|re: '(?i)(ledger|trezor|exodus)'
  filter_official_paths:
    Image|startswith:
      - 'C:\Program Files\Ledger'
      - 'C:\Program Files\Trezor'
  condition: selection_telegram and selection_wallet_proc and not filter_official_paths
falsepositives:
  - None expected; official wallet apps do not call Telegram Bot API
level: critical
tags:
  - attack.exfiltration
  - attack.t1567
  - attack.credential_access
date: 2026/08/19

// Multi-campaign IOC + behavior hunt: ValleyRAT, QUICSILVER, ASTERIX
let KnownHashes = dynamic([
  "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d",
  "c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02",
  "0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39",
  "0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f",
  "4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8",
  "7073b2a3a34525c5969921dd17ef1fa5607af92be78b3fc6129cdea73216691a",
  "918fa540126b7db6424652d84a5ce7e968947136db3d6e3e0cab30ea309e25a2",
  "961a398a5c71e837626b5fce68e44b14a5d220e3bd74a3d0ecd61a2762c38176",
  "ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19"
]);
let C2IPs = dynamic(["103.240.196.115", "136.0.213.184"]);
let PhishDomains = dynamic(["ledgerhelp.com"]);
let TimeWindow = ago(14d);
union isfuzzy=true
  (DeviceNetworkEvents
   | where TimeGenerated > TimeWindow
   | where RemoteIP in (C2IPs) or RemoteUrl in (PhishDomains)
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl, RemotePort, ActionType, Campaign="ValleyRAT/ASTERIX-C2"),
  (DeviceFileEvents
   | where TimeGenerated > TimeWindow
   | where SHA256 in (KnownHashes)
   | project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, Campaign="Malware-Artifact"),
  (DeviceProcessEvents
   | where TimeGenerated > TimeWindow
   | where FileName =~ "Overwolf.exe" and InitiatingProcessFileName !=~ "Overwolf.exe"
     or ProcessCommandLine has_any (".vhd", ".vhdx") and ProcessCommandLine matches regex @"(?i)\.(jpeg|jpg|png)\.(vhd|vhdx)"
   | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, Campaign="Sideload/VHD-Exec"),
  (DeviceNetworkEvents
   | where TimeGenerated > TimeWindow
   | where RemoteUrl == "api.telegram.org"
     and InitiatingProcessFileName matches regex @"(?i)(ledger|trezor|exodus)"
   | project TimeGenerated, DeviceName, InitiatingProcessFileName, RemoteUrl, Campaign="ASTERIX-Exfil")
| sort by TimeGenerated desc

# Security Arsenal - OTX Pulse IOC Hunt (ValleyRAT / QUICAgent / ASTERIX)
# Run elevated on suspected endpoints or deploy via RMM/Intune

$report = @()
$sha256s = @(
  "2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d",
  "c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02",
  "0f2c7194f1f577e73460db9ec2e75fc0c7f845588cbd4246333b7a4fbec90d9f",
  "4bee9affff9fa718a2c94f02ebe6a75143d4d461d291c2df9b769920fc927bf8",
  "ba9d459169a303067a4fe36c8b8582a5ea023b9c270dafe89613bab840501b19"
)

Write-Host "[1] Scanning user-writable dirs for known malicious hashes..." -ForegroundColor Cyan
$paths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:TEMP", "C:\Users\Public", "$env:USERPROFILE\Downloads")
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem -Path $p -Recurse -File -Include *.dll,*.exe,*.bin,*.dat -ErrorAction SilentlyContinue | ForEach-Object {
      $h = (Get-FileHash -Algorithm SHA256 $_.FullName -ErrorAction SilentlyContinue).Hash
      if ($sha256s -contains $h.ToLower()) {
        $report += [PSCustomObject]@{Type="HashMatch"; Detail=$_.FullName; SHA256=$h}
        Write-Host "  [!] MALICIOUS FILE: $($_.FullName)" -ForegroundColor Red
      }
    }
  }
}

Write-Host "[2] Checking for Overwolf sideload artifacts (signed exe + unsigned DLL co-location)..." -ForegroundColor Cyan
Get-ChildItem -Path "$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData" -Recurse -Filter "Overwolf*.exe" -ErrorAction SilentlyContinue | ForEach-Object {
  $dlls = Get-ChildItem -Path $_.DirectoryName -Filter *.dll -ErrorAction SilentlyContinue
  foreach ($d in $dlls) {
    $sig = Get-AuthenticodeSignature $d.FullName
    if ($sig.Status -ne "Valid") {
      $report += [PSCustomObject]@{Type="SideloadSuspect"; Detail=$d.FullName; SHA256=(Get-FileHash $d.FullName).Hash}
      Write-Host "  [!] Unsigned DLL beside Overwolf: $($d.FullName)" -ForegroundColor Yellow
    }
  }
}

Write-Host "[3] Checking VHD mounts and recent VHD artifacts (QUICSILVER)..." -ForegroundColor Cyan
Get-DiskImage -ImagePath *.vhd* -ErrorAction SilentlyContinue | Where-Object {$_.Attached} | ForEach-Object {
  $report += [PSCustomObject]@{Type="MountedVHD"; Detail=$_.ImagePath; SHA256="N/A"}
  Write-Host "  [!] Mounted VHD: $($_.ImagePath)" -ForegroundColor Red
}
Get-ChildItem "$env:USERPROFILE\Downloads","$env:TEMP" -Recurse -Include *.vhd,*.vhdx -ErrorAction SilentlyContinue | ForEach-Object {
  $report += [PSCustomObject]@{Type="VHDFile"; Detail=$_.FullName; SHA256=(Get-FileHash $_.FullName).Hash}
}

Write-Host "[4] Network checks: C2 IPs, QUIC/UDP443, Telegram exfil..." -ForegroundColor Cyan
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {$_.RemoteAddress -in @("103.240.196.115","136.0.213.184")} | ForEach-Object {
  $proc = (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName
  $report += [PSCustomObject]@{Type="C2Connection"; Detail="$($_.RemoteAddress):$($_.RemotePort) via $proc"; SHA256="N/A"}
  Write-Host "  [!] C2 CONNECTION: $($_.RemoteAddress) [$proc]" -ForegroundColor Red
}
Get-NetUDPEndpoint -ErrorAction SilentlyContinue | Where-Object {$_.RemotePort -eq 443} | ForEach-Object {
  $report += [PSCustomObject]@{Type="QUIC-UDP443"; Detail="Remote $($_.RemoteAddress) PID $($_.OwningProcess)"; SHA256="N/A"}
}

Write-Host "[5] Persistence sweep: Run keys + scheduled tasks referencing temp/appdata..." -ForegroundColor Cyan
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run","HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($k in $runKeys) {
  (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties | Where-Object {$_.Value -match "AppData|Temp|Public"} | ForEach-Object {
    $report += [PSCustomObject]@{Type="RunKey"; Detail="$k -> $($_.Name)=$($_.Value)"; SHA256="N/A"}
    Write-Host "  [!] Suspicious Run key: $($_.Name)" -ForegroundColor Yellow
  }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {$_.Actions.Execute -match "AppData|Temp" -and $_.TaskPath -notmatch "Microsoft"} | ForEach-Object {
  $report += [PSCustomObject]@{Type="ScheduledTask"; Detail="$($_.TaskName): $($_.Actions.Execute)"; SHA256="N/A"}
}

Write-Host "[6] Fake wallet app check (ASTERIX - Ledger/Trezor/Exodus outside Program Files)..." -ForegroundColor Cyan
Get-ChildItem "$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public" -Recurse -Include *.exe -ErrorAction SilentlyContinue | Where-Object {$_.Name -match "(?i)ledger|trezor|exodus"} | ForEach-Object {
  $report += [PSCustomObject]@{Type="FakeWalletApp"; Detail=$_.FullName; SHA256=(Get-FileHash $_.FullName).Hash}
  Write-Host "  [!] SUSPICIOUS WALLET BINARY: $($_.FullName)" -ForegroundColor Red
}

$report | Export-Csv -Path "$env:TEMP\otx_hunt_report.csv" -NoTypeInformation
Write-Host "`nHunt complete. $($report.Count) findings -> $env:TEMP\otx_hunt_report.csv" -ForegroundColor Green