VectraRAT MaaS Platform, Noodle RAT Espionage Kit & APT36 Operation RapidRust: OTX Pulse Analysis — Multi-Family Detection Pack

---
title: VectraRAT Implant Execution and UAC Bypass Behavior
id: 9a1f2c3e-7b4d-4e1a-9c5f-2d8a6b0e1f11
status: experimental
description: Detects execution patterns associated with the VectraRAT MaaS implant including ClickFix-delivered payloads, UAC bypass abuse, and clipboard hijack staging
author: Security Arsenal Threat Intelligence
date: 2026/09/17
references:
    - https://socradar.io/blog/vectrarat-undocumented-stack-maas
logsource:
    category: process_creation
    product: windows
detection:
    selection_clickfix:
        ParentImage|endswith:
            - '\mshta.exe'
            - '\powershell.exe'
            - '\cmd.exe'
        CommandLine|contains:
            - 'powershell -ep bypass'
            - 'Invoke-WebRequest'
            - 'iex('
    selection_uac_bypass:
        Image|endswith:
            - '\fodhelper.exe'
            - '\computerdefaults.exe'
            - '\sdclt.exe'
    selection_amadey_loader:
        CommandLine|contains:
            - 'rundll32'
            - 'regsvr32 /s'
    condition: selection_clickfix or (selection_uac_bypass and selection_amadey_loader)
falsepositives:
    - Legitimate software deployment tooling
level: high
tags:
    - attack.execution
    - attack.privilege_escalation
    - attack.t1548.002
    - attack.t1059
---
title: APT36 RUSTYSHADE GitHub Repository C2 Communication
id: 3b7e9d1a-5c2f-4a8b-b6d3-1e9f0a4c7d22
status: experimental
description: Detects non-browser processes making sustained HTTPS connections to GitHub API endpoints consistent with RUSTYSHADE dead-drop C2 via private repositories
author: Security Arsenal Threat Intelligence
date: 2026/09/17
references:
    - https://www.zscaler.com/blogs/security-research/operation-rapidrust-apt36-deploys-rustyshade-rustymove-psnatch-and
logsource:
    category: network_connection
    product: windows
detection:
    selection_github_api:
        DestinationHostname|contains:
            - 'api.github.com'
            - 'raw.githubusercontent.com'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\firefox.exe'
            - '\msedge.exe'
            - '\git.exe'
            - '\githubdesktop.exe'
            - '\code.exe'
    condition: selection_github_api and not filter_browsers
falsepositives:
    - CI/CD agents and developer automation scripts
    - Package managers pulling dependencies from GitHub
level: high
tags:
    - attack.command_and_control
    - attack.t1102
    - attack.t1071.001
---
title: Noodle RAT Cross-Platform Persistence and Loader Activity
id: 5d2c8f4b-1a6e-4b9c-c3f7-8d1e5a0b3f33
status: experimental
description: Detects MULTIDROP/MICROLOAD loader execution and service-based persistence associated with Noodle RAT (ANGRYREBEL) on Windows and Linux hosts
author: Security Arsenal Threat Intelligence
date: 2026/09/17
references:
    - https://cyberint.com/blog/dark-web/noodle-rat-a-recipe-for-cross-platform-espionage
logsource:
    category: process_creation
    product: windows
detection:
    selection_service_persist:
        Image|endswith:
            - '\sc.exe'
            - '\net.exe'
            - '\net1.exe'
        CommandLine|contains:
            - 'create'
            - 'binpath'
            - 'start='
    selection_tmp_exec:
        CommandLine|contains:
            - '\Temp\'
            - '\AppData\Local\Temp\'
            - '\ProgramData\'
        Image|endswith:
            - '\svchost.exe'
    condition: selection_service_persist and selection_tmp_exec
falsepositives:
    - Enterprise software installers registering services
level: medium
tags:
    - attack.persistence
    - attack.t1543.003
    - attack.t1055

// Security Arsenal — Multi-Family Threat Hunt
// VectraRAT C2, Noodle RAT C2, and APT36 GitHub dead-drop C2
let C2IPs = dynamic(["91.92.242.236", "178.16.54.148", "58.181.61.142", "137.220.158.91"]);
let IOC_SHA256 = dynamic(["33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f", "51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9", "7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3", "7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0"]);
let NetHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in (C2IPs)
   or (RemoteUrl has_any ("api.github.com", "raw.githubusercontent.com")
       and InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe", "git.exe", "code.exe", "githubdesktop.exe"))
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256;
let FileHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where SHA256 in (IOC_SHA256) or SHA1 has_any ("05a873fcac5373d5c3b24b2541b7b861cc4c5c05", "6bd5c6af884d46638ebc60434cfd35b37c1d3dd4", "00aff1a72c5d5635ab36ce2eb370718a7f0557a0")
   or ProcessCommandLine has_any ("fodhelper", "computerdefaults", "powershell -ep bypass")
| project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, SHA256, InitiatingProcessFileName;
union NetHits, FileHits
| sort by TimeGenerated desc

# Security Arsenal — Host-Level IOC Hunt: VectraRAT / Noodle RAT / APT36 RapidRust
# Run elevated on suspected endpoints. Checks persistence, artifacts, and live connections.

$Report = @()

# 1. Registry Run key persistence (VectraRAT, APT36 GOSHELL)
$RunKeys = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run'
)
foreach ($Key in $RunKeys) {
    if (Test-Path $Key) {
        Get-ItemProperty $Key | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match 'Temp|AppData|ProgramData|\.ps1|mshta|rundll32'
            } | ForEach-Object {
                $Report += [PSCustomObject]@{ Check='RegistryRunKey'; Artifact=$Key; Value="$($_.Name) = $($_.Value)" }
            }
        }
    }
}

# 2. Scheduled tasks pointing to suspicious paths (APT36 persistence, Amadey)
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'powershell|cmd|wscript|mshta' -and
    ($_.Actions.Arguments -match 'Temp|AppData|bypass|hidden|iex')
} | ForEach-Object {
    $Report += [PSCustomObject]@{ Check='ScheduledTask'; Artifact=$_.TaskName; Value="$($_.Actions.Execute) $($_.Actions.Arguments)" }
}

# 3. Live connections to known C2 (VectraRAT, Noodle RAT)
$C2s = @('91.92.242.236','178.16.54.148','58.181.61.142','137.220.158.91')
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $C2s -contains $_.RemoteAddress } | ForEach-Object {
        $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $Report += [PSCustomObject]@{ Check='C2Connection'; Artifact=$_.RemoteAddress; Value="PID $($_.OwningProcess) - $($Proc.ProcessName) - $($Proc.Path)" }
    }

# 4. Non-browser processes talking to GitHub API (RUSTYSHADE dead-drop C2)
Get-NetTCPConnection -State Established -RemotePort 443 -ErrorAction SilentlyContinue | ForEach-Object {
    $Proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($Proc -and $Proc.ProcessName -notmatch 'chrome|msedge|firefox|git|Code|GitHubDesktop') {
        try {
            $IP = [System.Net.Dns]::GetHostAddresses($_.RemoteAddress) | Out-Null
            $Host_ = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
            if ($Host_ -match 'github') {
                $Report += [PSCustomObject]@{ Check='GitHubC2Suspect'; Artifact=$Host_; Value="$($Proc.ProcessName) (PID $($Proc.Id)) -> $($_.RemoteAddress)" }
            }
        } catch {}
    }
}

# 5. Hash-sweep common staging directories for known-bad samples
$BadMD5 = @('2ed675d3342f069b6ebb090ee8085f43','7899b3e9e899acc932c7839d37ef0c74','89706fa83374ddd3d52ac569d876ac6a','40a75f87f1e52c33df9ca733aaf8ebbb','aade06ec611d69f1553035f22356ccf4','ae77f1834ccde53258bc27a779102af2','f16f507a8ed515663a4f07050cd97a74','40cab74bfacd7ba8fa46c8dcbdf7cae3')
$Paths = @("$env:TEMP","$env:LOCALAPPDATA\Temp","C:\ProgramData")
foreach ($P in $Paths) {
    Get-ChildItem $P -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $H = (Get-FileHash $_.FullName -Algorithm MD5 -ErrorAction SilentlyContinue).Hash
        if ($BadMD5 -contains $H.ToLower()) {
            $Report += [PSCustomObject]@{ Check='MaliciousFile'; Artifact=$_.FullName; Value="MD5 $H" }
        }
    }
}

$Report | Format-Table -AutoSize
if ($Report.Count -eq 0) { Write-Host "[+] No IOC artifacts found on $env:COMPUTERNAME" -ForegroundColor Green }
else { Write-Host "[!] $($Report.Count) suspicious artifacts found — isolate host and escalate to IR" -ForegroundColor Red }