SiriusQT, Stadia (StealC v2) & RemControl: MaaS Infostealer Resurgence — OTX Pulse Analysis & Enterprise Detection Pack

Threat Summary

Five concurrent OTX pulses paint a single, coherent picture: the infostealer and RAT ecosystem has fully reconstituted itself after law enforcement disruption, and it is operating on a mature Malware-as-a-Service (MaaS) commercial model sold through dark web forums and Telegram channels.

The through-lines across this intelligence:

1. Operation Endgame failed to kill the market. Four months after the June takedown of StealC's infrastructure, its seller returned in October with Stadia — a full RAT that embeds StealC's stealer code verbatim. This is classic takedown-resilient rebranding: same codebase, new brand, new C2, new customers.
2. RATs are absorbing stealers. SiriusQT (sold by reseller GhostKernel since April 2026, 30+ licensed buyers) bundles HVNC, credential theft, crypto-wallet harvesting, clipboard monitoring, and keylogging into one commercial package alongside legacy families (Remcos, XWorm, AsyncRAT, QuasarRAT, njRAT, RedLine, NETWIRE) in the same distribution ecosystem.
3. Delivery has shifted to user-executed social engineering. The ClickFix fake-CAPTCHA technique (victims paste attacker commands into the Windows Run dialog) is delivering DarkGate, Matanbuchus, Amatera, Wacatac, and Amadey through bulletproof host AS202412 (OMEGATECH LTD, Seychelles). Armorsteal uses SEO poisoning against people searching for Chocolatey and Microsoft Activation Scripts commands — targeting users who intend to run PowerShell anyway.
4. Mobile banking credential theft is industrializing. RemControl (attributed to actor UNKK, MaaS since May 2026) abuses Android Accessibility Services to overlay phishing pages on 30+ financial institutions across Western Europe and Canada, streams device screens, and harvests PINs — distributed via malvertising for fake TVTap IPTV pages.

Collective objective: bulk credential, session cookie, crypto-wallet, and banking-PIN theft at scale, feeding initial access brokerage and account takeover. The targeting is opportunistic and global — US, UK, EU, Russia, China, Canada — which means every enterprise is in-scope.

Threat Actor / Malware Profile

SiriusQT (Reseller: GhostKernel)

• Distribution: MaaS sold on dark web forums since April 2026; 30+ confirmed license buyers means dozens of independent operators with varied delivery vectors (malspam, cracked software, trojanized installers).
• Payload behavior: HVNC (hidden virtual network computing) for invisible desktop sessions, browser credential/cookie theft, cryptocurrency wallet collection, clipboard monitoring (crypto address swap), keylogging, process injection.
• Persistence: Registry Run keys and scheduled tasks; process injection into legitimate Windows binaries to survive basic AV sweeps.
• C2: Mixed infrastructure — bulletproof IPs (193.161.193.99, 5.181.80.130, 185.69.122.235, 185.182.65.150, 185.196.8.145) plus dynamic DNS (xweb.ddns.net) and tunneling services (tcp.cloudpub.ru) for C2 obfuscation. Co-mingled with crax.pro cracking-community infrastructure.
• Anti-analysis: HVNC sessions hidden from the user's visible desktop; injection into trusted processes defeats simple parent/child allowlisting.

Stadia (StealC successor)

• Distribution: Same seller as StealC, relaunched post-Endgame. Stadia's panel and builder marketed where StealC was sold.
• Payload behavior: Full RAT feature set — hidden desktop, live command shell, file explorer, process manager, in-memory loader — wrapped around StealC's verbatim stealer module (browser creds, cookies, wallets).
• C2: 93.152.213.215, 193.148.56.97, stadiadev.cc.
• Anti-analysis: In-memory payload loading to minimize disk artifacts; code reuse from StealC means existing StealC YARA/Sigma detections have partial efficacy — tune them rather than discard them.

RemControl (Actor: UNKK)

• Distribution: Malvertising → fake TVTap IPTV download pages → malicious APK sideload. MaaS since May 2026.
• Payload behavior: Android Accessibility Service abuse for overlay injection of pixel-perfect banking phishing screens, device screen streaming, PIN capture, Telegram dead-drop C2 configuration.
• Targets: 30+ financial institutions in Canada, France, Italy, Poland, Portugal, Spain; overlap with the Medusa banking trojan ecosystem.
• Anti-analysis: AI-generated overlays (rapid retargeting to new banks), dead-drop resolution via Telegram defeats static C2 blocking.

ClickFix Loader Chains (AS202412 / OMEGATECH LTD)

• Distribution: Compromised legitimate sites + disposable domains (.shop, .sbs, .beer TLDs) serving fake CAPTCHA pages that instruct victims to press Win+R and paste a command.
• Payload behavior: The pasted command (typically mshta, powershell, or curl-based) pulls second-stage DarkGate / Matanbuchus / Amatera / Amadey / Wacatac.
• C2 resilience: EtherHiding — C2 addresses stored in blockchain transactions, making takedown extremely difficult. Disposable domains, durable hosting.

Armorsteal

• Distribution: SEO poisoning + typosquatting of Chocolatey and Microsoft Activation Scripts (MAS) — e.g., massgravel.net impersonating massgrave.dev. Victims copy malicious PowerShell one-liners from fake documentation.
• Payload behavior: Three-component Python malware (remote access, stealer, clipboard hijacker) packed with Pyarmor.
• C2: 186.2.163.185, 190.115.31.69, 186.2.175.183, 82.153.135.80 (LATAM-hosted bulletproof ranges).
• Anti-analysis: Pyarmor obfuscation defeats static Python decompilation; execution via user-invoked PowerShell bypasses email/web gateway inspection entirely.

IOC Analysis

Indicator composition across the five pulses (702 total IOCs):

Operationalization guidance for SOC teams:

• IPs/domains first. Network indicators from these pulses are high-fidelity and low-false-positive. Push to perimeter block within the hour. The 185.x.x.x and 186.2.x.x ranges warrant /24-level passive DNS review for neighbor C2s.
• Hashes second, with retro-hunt. 650+ hashes (mostly RemControl APK variants and Stadia/Armorsteal binaries) should go into your EDR's blocklist AND a 90-day retrospective sweep — MaaS buyers may have detonated these weeks before the pulse published.
• massgravel.net is a canary. Any DNS resolution of this domain indicates a user who was searching for activation tooling — a policy violation and a compromise indicator simultaneously. Investigate the endpoint AND the user's intent.
• Tooling: Decode/triage with OTX DirectConnect API pulls into your TIP (ThreatConnect, MISP, OpenCTI); pivot passive DNS with VirusTotal/SecurityTrails; validate hashes against MalwareBazaar before blocking (some may be shared with research samples). For blockchain C2 (EtherHiding), network blocking fails — focus on the loader behavior instead.

Detection Engineering

The following detections target the specific behaviors in these pulses: ClickFix user-executed commands, PowerShell-pulled Python/Pyarmor payloads, RAT persistence, and C2 egress to the named infrastructure.

---
title: ClickFix Fake CAPTCHA User-Executed Command (Run Dialog Spawn)
id: 8f2a1c4e-6d3b-4a1f-9c2e-7b5d8e1f3a01
status: production
description: Detects explorer.exe spawning script interpreters or LOLBins consistent with ClickFix fake-CAPTCHA pages instructing victims to paste commands into the Windows Run dialog (Win+R). Observed delivering DarkGate, Matanbuchus, Amatera, Amadey, Wacatac via AS202412 infrastructure.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\curl.exe'
      - '\rundll32.exe'
  selection_flags:
    CommandLine|contains:
      - 'http://'
      - 'https://'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'mshta'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Rare legitimate Run-dialog administrative commands; tune on command line length and external URL presence
level: high
tags:
  - attack.initial_access
  - attack.t1204.002
  - attack.t1059
  - attack.t1218.005
---
title: PowerShell Spawning Python - Armorsteal Pyarmor Payload Execution
id: 4c7d9e2b-1a5f-4b8c-8d3a-6e9f2c4b7d02
status: production
description: Detects PowerShell or cmd launching python/pythonw executables, matching the Armorsteal SEO-poisoning chain where malicious PowerShell one-liners (from fake Chocolatey/MAS sites such as massgravel.net) deploy Pyarmor-protected Python stealer components.
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cmd.exe'
  selection_child:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
  filter_legit_paths:
    Image|startswith:
      - 'C:\Program Files\'
      - 'C:\Program Files (x86)\'
  condition: selection_parent and selection_child and not filter_legit_paths
falsepositives:
  - Developer workstations and legitimate Python automation; restrict alerting to user-profile and temp paths (AppData, Temp, Downloads, Public)
level: high
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.006
  - attack.t1027
---
title: SiriusQT / Stadia RAT Persistence and C2 Infrastructure
id: 2b6e8f1a-9c4d-4e7a-a5b3-1d8f6c2e9a03
status: production
description: Detects registry Run-key persistence combined with network egress to known SiriusQT/Stadia/Armorsteal C2 infrastructure identified in OTX pulses. Covers HVNC RAT persistence and post-Endgame StealC/Stadia callback behavior.
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: windows
detection:
  selection_ip:
    DestinationIp:
      - '193.161.193.99'
      - '5.181.80.130'
      - '185.69.122.235'
      - '185.182.65.150'
      - '185.196.8.145'
      - '93.152.213.215'
      - '193.148.56.97'
      - '186.2.163.185'
      - '190.115.31.69'
      - '186.2.175.183'
      - '82.153.135.80'
  selection_domain:
    DestinationHostname:
      - 'xweb.ddns.net'
      - 'tcp.cloudpub.ru'
      - 'crax.pro'
      - 'stadiadev.cc'
      - 'massgravel.net'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: (selection_ip or selection_domain) and not filter_browsers
falsepositives:
  - Threat research and sandbox detonation environments; browser filter removes incidental web visits while preserving C2 callbacks from injected/unknown processes
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1572
  - attack.persistence
  - attack.t1068

// Security Arsenal — OTX Pulse Hunt: SiriusQT / Stadia / Armorsteal / ClickFix chains
// Hunt window: 30 days. Run in Microsoft Sentinel or MDE Advanced Hunting.
let C2IPs = dynamic(["193.161.193.99","5.181.80.130","185.69.122.235","185.182.65.150","185.196.8.145","93.152.213.215","193.148.56.97","186.2.163.185","190.115.31.69","186.2.175.183","82.153.135.80"]);
let C2Domains = dynamic(["xweb.ddns.net","tcp.cloudpub.ru","crax.pro","stadiadev.cc","massgravel.net","alianzeg.shop","newtdsone.shop","ai-nexora.sbs","cdn-2faclov.sbs","lcates-vs.beer","capcha-cdn-js.beer","cdn-plugin-js.beer","carrotbunnies.com"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in~ (C2IPs) or RemoteUrl in~ (C2Domains)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
| extend HuntType = "C2 Network Connection";
let ClickFixBehavior = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","curl.exe","wscript.exe","cscript.exe")
| where ProcessCommandLine has_any ("http","IEX","Invoke-Expression","DownloadString")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend HuntType = "ClickFix Run-Dialog Execution";
let PyarmorChain = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("powershell.exe","cmd.exe")
| where FileName in~ ("python.exe","pythonw.exe")
| where ProcessCommandLine has_any ("AppData","Temp","Public","Downloads")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, AccountName
| extend HuntType = "PowerShell-to-Python Armorsteal Chain";
union NetworkHits, ClickFixBehavior, PyarmorChain
| sort by TimeGenerated desc

# Security Arsenal — OTX IOC Endpoint Hunt (SiriusQT / Stadia / Armorsteal / ClickFix)
# Run elevated on suspect endpoints or deploy fleet-wide via your RMM/EDR scripting module.

$C2Indicators = @(
    '193.161.193.99','5.181.80.130','185.69.122.235','185.182.65.150',
    '185.196.8.145','93.152.213.215','193.148.56.97','186.2.163.185',
    '190.115.31.69','186.2.175.183','82.153.135.80'
)
$C2Domains = @('xweb.ddns.net','tcp.cloudpub.ru','crax.pro','stadiadev.cc','massgravel.net')
$StadiaHashes = @(
    '028afae8b5e9953e1cd84a003c42fd85','7739a8d0d101ca82b93bbd0acdb6d9af',
    '0e5337a4cc8ebc772bc50f6e79befd1e8efad3410022e050d08d5269733c4ea4',
    'ea928494fd30d88b98141d39a502a4324889fb732e74b44bfee12c72137dd73e'
)

$findings = @()

# 1. Active network connections to C2 infrastructure
$conns = Get-NetTCPConnection -State Established,SynSent -ErrorAction SilentlyContinue
foreach ($c in $conns) {
    if ($C2Indicators -contains $c.RemoteAddress) {
        $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
        $findings += [PSCustomObject]@{Type='C2 Connection'; Detail="$($proc.ProcessName) -> $($c.RemoteAddress):$($c.RemotePort)"; Severity='CRITICAL'}
    }
}

# 2. DNS cache check for C2 / impersonation domains
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue
foreach ($d in $dns) {
    foreach ($bad in $C2Domains) {
        if ($d.Entry -like "*$bad*") {
            $findings += [PSCustomObject]@{Type='DNS Cache Hit'; Detail="$($d.Entry) resolved to $($d.Data)"; Severity='HIGH'}
        }
    }
}

# 3. RAT persistence: Run keys with suspicious paths (SiriusQT/Stadia pattern)
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce')
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match 'AppData|Temp|Public|Roaming.*\.exe|pythonw') {
                $findings += [PSCustomObject]@{Type='Suspicious Run Key'; Detail="$key\$($_.Name) = $val"; Severity='HIGH'}
            }
        }
    }
}

# 4. Scheduled tasks executing from user-writable paths
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $action = ($_.Actions | Select-Object -First 1).Execute
    if ($action -match 'AppData|Temp|Public|Users\\Default') {
        $findings += [PSCustomObject]@{Type='Suspicious Scheduled Task'; Detail="$($_.TaskName) -> $action"; Severity='MEDIUM'}
    }
}

# 5. Hash sweep of common staging directories for Stadia samples
$dirs = @("$env:TEMP","$env:LOCALAPPDATA\Temp","$env:USERPROFILE\Downloads","C:\Users\Public")
foreach ($dir in $dirs) {
    if (Test-Path $dir) {
        Get-ChildItem $dir -Recurse -File -Include *.exe,*.dll,*.py,*.pyc -ErrorAction SilentlyContinue | ForEach-Object {
            $md5 = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
            $sha = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
            if ($StadiaHashes -contains $md5.ToLower() -or $StadiaHashes -contains $sha.ToLower()) {
                $findings += [PSCustomObject]@{Type='Known Malware Hash'; Detail=$_.FullName; Severity='CRITICAL'}
            }
        }
    }
}

if ($findings.Count -eq 0) { Write-Output "[+] No OTX indicator hits on $env:COMPUTERNAME" }
else { $findings | Sort-Object Severity | Format-Table -AutoSize; $findings | Export-Csv "C:\Temp\otx_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }

Response Priorities

Immediate (0–4 hours)

• Block all 11 IPv4 C2 addresses and 13 domains from these pulses at the egress firewall, proxy, and DNS layer. Treat any existing session to these IPs as an active compromise.
• Run the KQL hunt fleet-wide with a 30-day lookback. Any ClickFix-behavior hit (explorer → powershell/mshta with URL) requires immediate endpoint isolation — the victim executed the payload themselves and may not report it.
• Sweep for massgravel.net DNS resolution. This domain indicates both compromise and software-piracy intent; isolate the host and queue the user for policy review.
• Deploy the PowerShell IOC hunt script to any endpoint showing anomalous egress or reported "weird CAPTCHA" user reports.

24 Hours — Identity Response (this is credential-theft malware; assume theft occurred)

• For every host with a confirmed or suspected SiriusQT/Stadia/Armorsteal hit: force password reset and revoke all active sessions/tokens for every user who logged into that machine — cookies and session tokens are the primary theft target, so MFA alone does not contain this.
• Revoke OAuth grants and refresh tokens (Entra ID sign-in logs → revoke sessions; Google Workspace → token audit). StealC-lineage malware steals session cookies that bypass MFA entirely.
• Audit crypto-wallet access and password-manager vault unlocks from affected hosts; SiriusQT specifically collects wallets and monitors the clipboard for address swapping.
• For EU/Canada financial-sector exposure to RemControl: push MDM policy blocking sideloaded APKs, audit enrolled Android devices for Accessibility Service grants to non-whitelisted apps, and force credential/PIN resets for mobile banking users on affected devices.

1 Week — Architectural Hardening

• Kill the ClickFix vector: deploy an Attack Surface Reduction posture or AppLocker policy blocking explorer.exe from spawning script interpreters (mshta, powershell, wscript) — there is almost no legitimate business workflow for Run-dialog → mshta → internet URL.
• Constrain Python execution: Armorsteal requires python.exe/pythonw.exe launched by PowerShell. WDAC/AppLocker rules restricting Python to signed, admin-installed paths neutralize the Pyarmor chain.
• Restrict Dynamic DNS and tunneling services (ddns.net, cloudpub.ru) at the DNS filter — SiriusQT abuses both for C2.
• SEO-poisoning awareness: push a targeted advisory to IT admins and power users — the Armorsteal victims were technically proficient people searching for admin tooling. Generic phishing training does not reach this audience; a specific "never paste commands from search results" bulletin does.
• Blockchain C2 (EtherHiding) note: network blocking cannot stop DarkGate/Amadey variants resolving C2 from smart contracts. Prioritize the loader-stage behavioral detection (Sigma rule 1) over infrastructure blocking for this family.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub