VOLTA infostealer uses AI models to rank victims by what they're worth
https://sockanalyst.com/patch-now/volta-infostealer-llm-victim-ranking

Splunk
index=edr (file_hash="57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279" OR file_name IN ("9BY0tjwOc3ut.exe","yLP9m5J3i2Aw.exe","volta_debug.txt","volta_dox.zip","volta_log.zip","volta_doxnet.zip") OR (process_name="chrome.exe" CommandLine="*--headless*" NOT parent_process_name IN ("node.exe","python.exe")))
| stats count min(_time) as first by host, user, process_name, file_name, CommandLine

Sentinel
let h = "57ef4242666d78c50df145b34023df564f0fad38812d6a580e66433d427e2279";
union isfuzzy=true
 (DeviceFileEvents | where SHA256 == h or FileName in~ ("9BY0tjwOc3ut.exe","yLP9m5J3i2Aw.exe","volta_debug.txt","volta_dox.zip","volta_log.zip","volta_doxnet.zip")),
 (DeviceProcessEvents | where SHA256 == h or (FileName =~ "chrome.exe" and ProcessCommandLine has "--headless" and InitiatingProcessFileName !in~ ("node.exe","python.exe"))),
 (DeviceNetworkEvents | where RemoteUrl has_any ("openrouter.ai","api.telegram.org") and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","telegram.exe"))
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, RemoteUrl, InitiatingProcessFileName