MalwarePublished 16 Sep 2026Updated 17 Oct 2026

VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch

Source AlienVault OTX General

Description

VectraRAT is a previously undocumented Malware-as-a-Service platform active since August 2022. It consists of a Go-based control server (VectraHub) and a native C++ Windows implant. The malware offers capabilities including hidden desktop control, keylogging, clipboard hijacking with cryptocurrency address replacement, browser credential theft, and a UAC bypass that elevates privileges without user prompts. It is distributed via Amadey loader and ClickFix campaigns using tax-themed lures. Victims include corporate Windows users, including Windows Server 2025, across multiple countries such as the United States, Russia, and Germany. Infrastructure analysis revealed exposed operational panels and directories across various hosting providers.

Impact

The malware enables attackers to gain persistent and stealthy access to infected Windows systems, including corporate and server environments. The capabilities allow theft of sensitive credentials, manipulation of clipboard data to redirect cryptocurrency transactions, and privilege escalation without user consent. This can lead to data theft, financial fraud, and unauthorized control of victim systems. The presence of exposed attacker infrastructure increases the risk of further compromise and operational security failures for the threat actor.

Defensive guidance

No specific patch or remediation is indicated for this malware platform. Mitigation should focus on detection and prevention of infection vectors such as the Amadey loader and ClickFix campaigns. Organizations should apply endpoint protection solutions capable of detecting these threats, monitor for indicators of compromise related to VectraRAT activity, and educate users to recognize and avoid tax-themed phishing lures. Since this is a malware platform rather than a software vulnerability, no vendor patch exists. Incident response should include containment and eradication of the malware from infected hosts.

Indicators of compromise

IP addresses 2

91.92.242.236
178.16.54.148CC=DE ASN=AS40999 dus.net gmbh

Hashes 36

2ed675d3342f069b6ebb090ee8085f43
7899b3e9e899acc932c7839d37ef0c74
89706fa83374ddd3d52ac569d876ac6a
a3dc3ee464737dd74c20ec771deaac4d
a8619784bfe927e551e831d4adaf8ba5
05a873fcac5373d5c3b24b2541b7b861cc4c5c05
1a5f6531962a08b29c8b5f1572383b52434f1428
5a68ece20d05c755d20975b4e1794d0f531d2c19
69c3e85b5f1fc3b7787147b18e0158db32b0662c
dbded25e78aa62d963f676665020917da09d32e5

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 16 Oct 2026, 18:48 UTC

MITRE ATT&CK techniques24 from threat tags

Technical details

Indicators of compromise

IP addresses 2

Hashes 36

Community reviews

Related threats