THREAT OPS › Threat News › VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch
VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch
<h1>VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch</h1> <p>SOCRadar’s Threat Research Unit (<strong>STRU</strong>) has documented VectraRAT, a Malware-as-a-Service platform built entirely from scratch rather than forked from leaked RAT code. Renting from $250 a month, it gives operators hidden-desktop control, keylogging, clipboard hijacking, browser credential theft, and a UAC bypa
Attributed threat actors
- Earth LuscaG1006
MITRE ATT&CK techniques
- Screen CaptureT1113
- KeyloggingT1056.001
- IP AddressesT1590.005
- JavaScriptT1059.007
- Bypass User Account ControlT1548.002
- Match Legitimate Resource Name or LocationT1036.005
- Spearphishing LinkT1566.002
- Spearphishing LinkT1598.003
- Automated CollectionT1119
- Clipboard DataT1115
- System Information DiscoveryT1082
- Application Layer ProtocolT1071
- Native APIT1106
- Deobfuscate/Decode Files or InformationT1140
- Credentials from Password StoresT1555
- Remote Access ToolsT1219
- MasqueradingT1036
- Unsecured CredentialsT1552
- Credentials from Web BrowsersT1555.003
- Abuse Elevation Control MechanismT1548
- ProxyT1090
- Command and Scripting InterpreterT1059
- Dynamic ResolutionT1568
- System Network Connections DiscoveryT1049
- Credentials In FilesT1552.001
- Process DiscoveryT1057
- Exfiltration Over C2 ChannelT1041
- Parent PID SpoofingT1134.004
- PowerShellT1059.001
- PhishingT1566
- Non-Standard PortT1571
- Invalid Code SignatureT1036.001
- Input CaptureT1056
- CredentialsT1589.001
- Non-Application Layer ProtocolT1095
- ImpersonationT1684.001
- Windows Command ShellT1059.003
- Access Token ManipulationT1134
- Internal ProxyT1090.001
- Command and Scripting InterpreterAML.T0050
- Unsecured CredentialsAML.T0055
- ImpersonationAML.T0073
- MasqueradingAML.T0074
- Process DiscoveryAML.T0089
Indicators of compromise
- e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0sha256
- dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08aesha256
- ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9sha256
- b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5esha256
- bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5sha256
- c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5sha256
- 8745e872ff8aa41b0e03737f76bf35b6c934106c987dff98afe34120e47caf91sha256
- bba58f99e14e3512c04a5a74a079d7851abf935dd258cff4c80874ce7cfc82e3sha256
- d8f15ba122cd6da01f83fe05294df80a6eadbce0f66dac7c2bcc0904f066e0desha256
- 3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7sha256
- 7b82f08120e0d9b16cd5b9ec59d24fb68e35735c82311a233d370e7f264af650sha256
- b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620sha256
- https://platform.socradar.com/url
- 86.109.75.168ipv4
- 91.92.242.236ipv4
- 178.16.54.148ipv4
- 86.109.75.161ipv4
- 195.63.145.106ipv4
- 195.20.115.77ipv4
- 91.219.236.179ipv4
- ip.cndomain
- my.ip.cndomain
Original source: https://socradar.io/blog/vectrarat-undocumented-stack-maas/