SiriusQT RAT, RemControl Banking Trojan & ClickFix AS202412 Hosting Cluster: OTX Pulse Analysis — Enterprise Detection Pack

Three OTX pulses published 2026-10-23 collectively paint a picture of a mature, commercialized cybercrime ecosystem where Malware-as-a-Service (MaaS) is the dominant distribution model. First, SiriusQT, a Windows RAT advertised on dark web forums since April 2026 and resold by the actor GhostKernel, bundles capabilities well beyond commodity remote administration: hidden VNC (HVNC), credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and layered persistence. The pulse aggregates a who's-who of commodity RAT and stealer families (Remcos, XWorm, AsyncRAT, QuasarRAT, njRAT/Njw0rm, LV, Bladabindi, RedLine Stealer, NETWIRE, BTMob), indicating shared infrastructure, reseller overlap, or builder-kit reuse across at least 30 license purchasers targeting nine countries including the US, UK, China, and Russia.

Second, RemControl, attributed to actor UNKK, is a previously undocumented Android banking trojan running as MaaS since May 2026. It targets 30+ financial institutions across Western Europe, the Middle East, and Canada via fake TVTap IPTV download pages pushed through malvertising. Its kill chain abuses Android Accessibility Services to inject phishing overlays over legitimate banking apps, streams device screens to operators, and uses Telegram dead-drops for C2 resolution — with AI reportedly used to generate the overlay pages, accelerating targeting of new banks.

Third, the AS202412 / OMEGATECH LTD pulse documents a five-month, four-chain loader operation riding a single Seychelles-registered bulletproof hosting provider. Every chain begins with a fake CAPTCHA page using the ClickFix social-engineering technique — victims are instructed to paste attacker commands into the Windows Run dialog — delivering DarkGate, Matanbuchus, Amatera, Wacatac, and Amadey. The operation rotates disposable domains (.shop, .sbs, .beer TLDs) while anchoring on durable hosting, and leverages EtherHiding (blockchain-based C2) to resist takedown.

Collectively: adversaries are industrializing initial access through MaaS resale, fake-CAPTCHA social engineering, and bulletproof infrastructure, with monetization split between endpoint credential/crypto theft (SiriusQT cluster), mobile banking fraud (RemControl), and loader-as-a-service delivery (AS202412 chains). Enterprise defenders should treat all three as current, active delivery risk.

Threat Actor / Malware Profile

SiriusQT (reseller: GhostKernel) — Windows RAT sold via dark web forum subscriptions. Distribution follows typical cracked-software, malvertising, and loader-droppper pathways. Payload behavior: HVNC sessions for invisible interactive control, browser/DPAPI credential extraction, cryptocurrency wallet file harvesting, clipboard hijacking (crypto address swap), keylogging, and process injection into legitimate Windows binaries to evade behavioral detection. Persistence is achieved through Run keys, scheduled tasks, and service installation. C2 in the observed sample includes hard IPs (193.161.193.99, 185.x ranges consistent with offshore VPS) and dynamic-DNS style hostnames (xweb.ddns.net, tcp.cloudpub.ru). The co-listing of RedLine Stealer, XWorm, AsyncRAT, and njRAT indicators suggests customers chain SiriusQT with stealer and second-stage RAT payloads.

RemControl (actor: UNKK) — Android banking trojan, MaaS model. Distribution via malvertising funnels to fake TVTap IPTV APK download pages. Once installed, it requests Accessibility Service permissions, then: injects AI-generated phishing overlays matching 30+ targeted banking apps, captures PINs/credentials, streams device screens to the operator in near real time, and intercepts SMS-based OTPs. C2 resolution uses Telegram dead-drop channels, complicating static blocking. Anti-analysis includes emulator checks, overlay obfuscation, and abuse of legitimate Android APIs that signature engines treat as benign.

AS202412 ClickFix chains (actor unknown; hosting: OMEGATECH LTD, Seychelles) — Four parallel infection chains sharing one bulletproof ASN. Initial access: fake CAPTCHA / "verify you are human" pages that instruct victims to press Win+R and paste a clipboard-planted command (typically mshta, powershell -w hidden, or curl-based staging). Delivered payloads include DarkGate, Matanbuchus, Amatera, Wacatac, and Amadey. Infrastructure tradecraft: disposable domains with patterned naming on cheap TLDs, compromised legitimate sites for redirect chains, and EtherHiding — C2 configuration stored in blockchain smart contracts — making sinkholing ineffective against the resolution layer.

IOC Analysis

The pulses contain three distinct indicator classes requiring different operational handling:

• IPv4 / hostnames (SiriusQT cluster, 551 total IOCs): High-value for egress blocking and retrospective NetFlow/proxy hunting. Dynamic-DNS entries (ddns.net, cloudpub.ru) should be blocked at DNS and flagged in any DNS query logs — legitimate enterprise use of these services is rare. Expect fast flux; pair IP blocks with JA3/JA4 TLS fingerprinting and the HVNC behavioral detections below rather than relying on IP lists alone.
• File hashes (RemControl, 27 IOCs): MD5/SHA1/SHA256 triplets of Android APKs. Operationalize by pushing SHA256 values to mobile threat defense (MTD), EDR custom-indicator lists, and VirusTotal/OTX retro-hunts. Hashes are brittle for MaaS (repackaging is trivial) — combine with the package-name and Accessibility Service behavioral detections.
• Domains (AS202412, 56 IOCs): Patterned disposable domains across .shop, .sbs, .beer TLDs. Block at DNS sinkhole and secure web gateway; alert on any HTTP(S) request to these TLDs containing cdn, capcha (note the misspelling), or plugin-js strings. ASN-level intelligence: consider alerting on all egress to AS202412 netblocks as a compensating control given durable hosting.

Tooling: OTX DirectConnect/API for automated indicator sync to SIEM; MISP or OpenCTI for indicator lifecycle management; urlscan.io and VirusTotal for domain/hash enrichment; Shodan/Censys for ASN netblock enumeration. Decode ClickFix clipboard commands with PowerShell script-block logging and Any.Run/Hybrid Analysis sandbox detonation of the lure pages.

Detection Engineering

The following rules target the specific behaviors in these pulses: ClickFix Run-dialog execution, RAT/stealer C2 egress to listed infrastructure, and common persistence patterns used by SiriusQT-class families.

---
title: ClickFix Fake CAPTCHA Run Dialog Command Execution
id: 9f2a4c7e-1b3d-4e5f-8a6c-202610230001
status: experimental
description: Detects user-pasted commands executed via Windows Run dialog consistent with ClickFix fake CAPTCHA campaigns delivering DarkGate, Matanbuchus, Amadey, and Amatera (OTX AS202412 pulse).
references:
    - https://activesoc.blackhillsinfosec.com/blog/disposable-domains-durable-hosting
author: Security Arsenal Threat Intelligence
 date: 2026/10/23
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_command:
        CommandLine|contains:
            - 'mshta'
            - 'powershell -w hidden'
            - 'powershell -WindowStyle Hidden'
            - 'curl '
            - 'certutil -urlcache'
            - 'rundll32 url.dll'
    filter_rundll_legit:
        CommandLine|contains: 'rundll32 url.dll,FileProtocolHandler https://'
    condition: selection_parent and selection_command and not filter_rundll_legit
falsepositives:
    - Rare admin use of Run dialog with scripted commands
level: high
tags:
    - attack.initial_access
    - attack.t1204.002
    - attack.t1059.001
---
title: SiriusQT Cluster Commodity RAT C2 Egress
id: 9f2a4c7e-1b3d-4e5f-8a6c-202610230002
status: experimental
description: Detects network connections to SiriusQT / XWorm / AsyncRAT / njRAT associated C2 infrastructure and dynamic DNS hostnames from OTX SiriusQT pulse.
references:
    - https://www.group-ib.com/blog/siriusqt-rat-hvnc-stealer/
author: Security Arsenal Threat Intelligence
date: 2026/10/23
logsource:
    category: network_connection
    product: windows
detection:
    selection_ip:
        DestinationIp:
            - '193.161.193.99'
            - '5.181.80.130'
            - '185.69.122.235'
            - '185.182.65.150'
            - '185.196.8.145'
    selection_dns:
        DestinationHostname|contains:
            - 'xweb.ddns.net'
            - 'tcp.cloudpub.ru'
            - 'crax.pro'
    condition: 1 of selection_*
falsepositives:
    - Unlikely in enterprise environments
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1571
---
title: RAT Persistence via Run Key or Scheduled Task with Suspicious Path
id: 9f2a4c7e-1b3d-4e5f-8a6c-202610230003
status: experimental
description: Detects persistence registration from user-writable or temp paths typical of SiriusQT, Remcos, XWorm, AsyncRAT, DarkGate, and Amadey families.
author: Security Arsenal Threat Intelligence
date: 2026/10/23
logsource:
    category: registry_set
    product: windows
detection:
    selection_key:
        TargetObject|contains:
            - '\CurrentVersion\Run'
            - '\CurrentVersion\RunOnce'
    selection_path:
        Details|contains:
            - '\AppData\Roaming\'
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
            - '%TEMP%'
    filter_legit:
        Details|contains:
            - 'OneDrive.exe'
            - 'Teams.exe'
            - 'Spotify.exe'
    condition: selection_key and selection_path and not filter_legit
falsepositives:
    - Legitimate user-mode updaters (filter as identified)
level: medium
tags:
    - attack.persistence
    - attack.t1547.001

// Security Arsenal — OTX 2026-10-23 hunt: SiriusQT C2, ClickFix execution, AS202412 domains
let RAT_IPs = dynamic(["193.161.193.99","5.181.80.130","185.69.122.235","185.182.65.150","185.196.8.145"]);
let RAT_Hosts = dynamic(["xweb.ddns.net","tcp.cloudpub.ru","crax.pro"]);
let ClickFix_Domains = dynamic(["alianzeg.shop","newtdsone.shop","ai-nexora.sbs","cdn-2faclov.sbs","lcates-vs.beer","capcha-cdn-js.beer","cdn-plugin-js.beer","carrotbunnies.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteIP in (RAT_IPs) or RemoteUrl has_any (RAT_Hosts, ClickFix_Domains)
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
    | extend HuntHit = "NetworkIOC"),
    (DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where ProcessCommandLine has_any ("mshta","powershell -w hidden","-WindowStyle Hidden","certutil -urlcache","curl ")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
    | extend HuntHit = "ClickFixRunDialog"),
    (DeviceRegistryEvents
    | where Timestamp > ago(30d)
    | where RegistryKey has_any ("\\CurrentVersion\\Run","\\CurrentVersion\\RunOnce")
    | where RegistryValueData has_any ("\\AppData\\Roaming\\","\\AppData\\Local\\Temp\\","\\ProgramData\\")
    | where RegistryValueData !has_any ("OneDrive.exe","Teams.exe")
    | project Timestamp, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName
    | extend HuntHit = "RTPersistence")
| sort by Timestamp desc

# Security Arsenal - OTX 2026-10-23 IOC & Artifact Hunt (SiriusQT / ClickFix / commodity RAT)
# Run elevated on suspect endpoints or deploy via RMM/Intune remediations.

$ratIPs   = @('193.161.193.99','5.181.80.130','185.69.122.235','185.182.65.150','185.196.8.145')
$ratHosts = @('xweb.ddns.net','tcp.cloudpub.ru','crax.pro')
$cfDoms   = @('alianzeg.shop','newtdsone.shop','ai-nexora.sbs','cdn-2faclov.sbs','lcates-vs.beer','capcha-cdn-js.beer','cdn-plugin-js.beer','carrotbunnies.com')
$findings = @()

# 1. Live network connections to RAT C2
$conns = Get-NetTCPConnection -State Established,SynSent -ErrorAction SilentlyContinue |
         Where-Object { $ratIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $p = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $findings += [pscustomobject]@{Type='C2Connection'; Detail="$($c.RemoteAddress):$($c.RemotePort) via $($p.ProcessName) [$($p.Path)]"}
}

# 2. DNS cache hits for C2 / ClickFix domains
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($entry in $dns) {
    foreach ($h in ($ratHosts + $cfDoms)) {
        if ($entry.Name -like "*$h*") { $findings += [pscustomobject]@{Type='DNSCache'; Detail=$entry.Name} }
    }
}

# 3. Run-key persistence pointing at user-writable paths
$runKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        (Get-ItemProperty $key).PSObject.Properties | Where-Object {
            $_.Value -match 'AppData|Temp|ProgramData' -and $_.Name -notmatch '^PS'
        } | ForEach-Object { $findings += [pscustomobject]@{Type='RunKey'; Detail="$key :: $($_.Name) = $($_.Value)"} }
    }
}

# 4. Scheduled tasks executing from suspicious paths (SiriusQT / DarkGate pattern)
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $action = ($_.Actions | Select-Object -First 1).Execute
    if ($action -match 'AppData|\\Temp\\|ProgramData.*\.(exe|bat|ps1|vbs|js)$') {
        $findings += [pscustomobject]@{Type='ScheduledTask'; Detail="$($_.TaskName) -> $action"}
    }
}

# 5. Recently created executables/scripts in staging dirs (ClickFix droppers)
$paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA\Temp","C:\ProgramData")
foreach ($path in $paths) {
    Get-ChildItem $path -Recurse -Depth 2 -ErrorAction SilentlyContinue |
        Where-Object { $_.Extension -match '\.(exe|ps1|bat|vbs|js|msi)$' -and $_.CreationTime -gt (Get-Date).AddDays(-14) } |
        ForEach-Object { $findings += [pscustomobject]@{Type='RecentBinary'; Detail="$($_.FullName) created $($_.CreationTime)"} }
}

if ($findings.Count -gt 0) { $findings | Format-Table -AutoSize; $findings | Export-Csv "$env:TEMP\otx_hunt_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation }
else { Write-Output "[+] No OTX 2026-10-23 artifacts found on $env:COMPUTERNAME" }

Response Priorities

Immediate (0–4 hours):

• Block the SiriusQT C2 IPs, hostnames, and crax.pro at the perimeter firewall, proxy, and DNS resolver; sinkhole the eight AS202412 ClickFix domains and consider alerting on all egress to AS202412 netblocks.
• Push the 27 RemControl SHA256 hashes to MTD/MDM and block sideloaded APKs matching fake TVTap IPTV packages on managed mobile fleets.
• Deploy the Sigma rules and run the KQL hunt across 30 days of telemetry; execute the PowerShell hunt on any host showing DNS cache hits to the listed domains.

Within 24 hours:

• Because SiriusQT, RedLine, and RemControl are credential/PIN stealers, any host or user with a confirmed hit requires full credential reset: domain passwords, session-token revocation, MFA re-registration, and cookie invalidation. For RemControl-exposed users, force banking password resets and review recent transactions for OTP-bypassed fraud.
• Audit clipboard-monitoring exposure: check for crypto wallet files (Electrum, Exodus, browser-extension wallets) on compromised endpoints and assume wallet keys are burned.

Within 1 week:

• Harden against ClickFix: deploy endpoint policies that detect or block explorer.exe-spawned mshta/powershell/curl chains; add user awareness content specifically covering fake-CAPTCHA paste-into-Run lures — this technique bypasses most attachment and macro controls because the user executes the payload manually.
• Restrict Android Accessibility Service grants via MDM policy to a vetted app allowlist; block installation from unknown sources fleet-wide.
• Implement DNS-level policy for disposable TLDs (.shop, .sbs, .beer) where no business need exists, and enable PowerShell Script Block Logging + AMSI to capture clipboard-staged commands at execution time.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub