VectraRAT MaaS Platform + APT36 Operation RapidRust: OTX Pulse Analysis — Infostealer & Espionage Detection Pack

---
title: VectraRAT / Amadey ClickFix Execution Chain
description: Detects ClickFix-style social engineering leading to Amadey loader or VectraRAT execution — child processes spawned from mshta/rundll32/powershell following clipboard-paste lures
id: 9f3a2b71-vec4-4rat-a001-vectrahub001
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\regsvr32.exe'
    selection_suspicious_cmd:
        CommandLine|contains:
            - 'curl'
            - 'Invoke-WebRequest'
            - 'iex'
            - 'DownloadString'
            - 'Start-BitsTransfer'
    condition: selection_parent and selection_child and selection_suspicious_cmd
falsepositives:
    - Enterprise software distribution scripts
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.t1204
    - malware.vectrarat
    - malware.amadey
date: 2026/09/17
---
title: APT36 RUSTYSHADE GitHub Repository C2 Communication
description: Detects non-browser, non-git process making HTTPS connections to GitHub API/raw endpoints — consistent with RUSTYSHADE dead-drop C2 over private repositories
id: 8e2b1c63-apt3-6rap-rust-rustyshade01
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|contains:
            - 'api.github.com'
            - 'raw.githubusercontent.com'
            - 'gist.githubusercontent.com'
    filter_legit:
        Image|endswith:
            - '\git.exe'
            - '\githubdesktop.exe'
            - '\code.exe'
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\devenv.exe'
    condition: selection_domain and not filter_legit
falsepositives:
    - Package managers (winget, npm, pip) and CI/CD agents
    - Developer tooling auto-updaters
level: high
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
    - apt.apt36
    - malware.rustyshade
date: 2026/09/17
---
title: Credential Stealer Execution — PSNATCH / Vidar Artifact Access
description: Detects PowerShell or script processes accessing browser credential stores, LSASS memory, or crypto wallet paths — matching PSNATCH and Vidar infostealer collection behavior
id: 7d1a0b42-cred-4stl-psnt-vidar00001
status: experimental
author: Security Arsenal Threat Intel
logsource:
    category: process_creation
    product: windows
detection:
    selection_creds:
        CommandLine|contains:
            - 'Login Data'
            - 'Local State'
            - '\Web Data'
            - 'os_crypt'
            - 'DPAPI'
            - 'CryptUnprotectData'
            - 'wallet.dat'
            - 'Exodus'
            - 'Electrum'
            - 'lsass'
            - 'comsvcs.dll'
            - 'MiniDump'
    selection_script:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
            - '\cmd.exe'
    condition: selection_creds and selection_script
falsepositives:
    - Legitimate password vault migrations
    - Forensic/IR tooling (authorize by process lineage)
level: critical
tags:
    - attack.credential_access
    - attack.t1555.003
    - attack.t1003.001
    - malware.psnatch
    - malware.vidar
date: 2026/09/17

// Sentinel hunt: VectraRAT C2 + APT36 GitHub-abuse C2 + stealer process lineage
let VectraC2 = dynamic(["91.92.242.236", "178.16.54.148"]);
let GitC2 = dynamic(["api.github.com", "raw.githubusercontent.com", "gist.githubusercontent.com"]);
union isfuzzy=true
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteIP in (VectraC2)
    | project TimeGenerated, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, IndicatorType="VectraRAT_C2_IP"),
    (DeviceNetworkEvents
    | where TimeGenerated > ago(7d)
    | where RemoteUrl has_any (GitC2)
    | where InitiatingProcessFileName !in~ ("git.exe","code.exe","chrome.exe","msedge.exe","firefox.exe","GitHubDesktop.exe","devenv.exe","node.exe")
    | project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName, InitiatingProcessCommandLine, IndicatorType="APT36_GitHub_C2"),
    (DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any ("Login Data","Local State","os_crypt","CryptUnprotectData","wallet.dat","MiniDump","comsvcs.dll")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName, IndicatorType="Credential_Theft_Behavior")
| order by TimeGenerated desc

# VectraRAT / APT36 RapidRust — Host IOC Hunt Script
# Run elevated via your RMM/EDR across the fleet; export results centrally.

$report = @()

# 1. Network connections to VectraRAT C2 infrastructure
$c2 = @('91.92.242.236','178.16.54.148')
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $c2 -contains $_.RemoteAddress }
foreach ($c in $conns) { $report += [pscustomobject]@{Check='VectraRAT_C2_Connection'; Detail="$($c.LocalAddress):$($c.LocalPort) -> $($c.RemoteAddress):$($c.RemotePort) State=$($c.State) PID=$($c.OwningProcess)"} }

# 2. Persistence: suspicious Run keys (Amadey/VectraRAT commonly land here)
$runPaths = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($p in $runPaths) {
    Get-ItemProperty -Path $p -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'AppData|Temp|ProgramData' -and $_.Value -match '&|powershell|mshta|rundll32|regsvr32' } |
            ForEach-Object { $report += [pscustomobject]@{Check='Suspicious_RunKey'; Detail="$p :: $($_.Name) = $($_.Value)"} }
    }
}

# 3. Persistence: recently created scheduled tasks launching from user-writable paths
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $act = $_.Actions | Where-Object { $_.Execute -match 'AppData|Temp|ProgramData' }
    if ($act) { $report += [pscustomobject]@{Check='Suspicious_ScheduledTask'; Detail="$($_.TaskName) -> $($act.Execute) $($act.Arguments)"} }
}

# 4. Hash sweep: known VectraRAT / RapidRust sample hashes in common staging dirs
$badHashes = @('2ed675d3342f069b6ebb090ee8085f43','7899b3e9e899acc932c7839d37ef0c74','89706fa83374ddd3d52ac569d876ac6a','a3dc3ee464737dd74c20ec771deaac4d','a8619784bfe927e551e831d4adaf8ba5','40a75f87f1e52c33df9ca733aaf8ebbb','aade06ec611d69f1553035f22356ccf4','ae77f1834ccde53258bc27a779102af2','f16f507a8ed515663a4f07050cd97a74')
$scanDirs = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:ProgramData")
foreach ($dir in $scanDirs) {
    Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($h -and ($badHashes -contains $h.ToLower())) { $report += [pscustomobject]@{Check='Malicious_FileHash'; Detail="$($_.FullName) MD5=$h"} }
    }
}

# 5. Non-git processes with recent GitHub API connections (RUSTYSHADE-style C2)
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.Name -notmatch '^(git|chrome|msedge|firefox|Code|GitHubDesktop|node|devenv)$') {
        try { $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost } catch { $dns = '' }
        if ($dns -match 'github') { $report += [pscustomobject]@{Check='Possible_GitHub_C2'; Detail="$($proc.Name) (PID $($proc.Id)) -> $($_.RemoteAddress) [$dns]"} }
    }
}

$report | Format-Table -AutoSize
if ($report.Count -gt 0) { $report | Export-Csv -Path "C:\IR\ioc_hunt_$env:COMPUTERNAME.csv" -NoTypeInformation }