#ParsedReport #CompletenessHigh
16-09-2026

VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch

https://socradar.io/blog/vectrarat-undocumented-stack-maas/

Report completeness: High

Threats:
Vectrarat
Clipboard_hijacking_technique
Uac_bypass_technique
Hvnc_tool
Amadey
Clickfix_technique
Uacme_tool
Vidar_stealer
Netsupportmanager_rat
Spear-phishing_technique

Victims:
Corporate organizations

Industry:
Government, Iot

Geo:
Russia, Asian, Germany, Russian, India, Chinese, Switzerland, United states, Venezuela, Czech republic, Budapest

TTPs:
Tactics: 9
Technics: 10

IOCs:
IP: 7
File: 9
Hash: 12

Soft:
Telegram, Linux, Chromium, Firefox, Internet Explorer

Algorithms:
lznt1, sha256

Functions:
ParseHeader

Win API:
FS, NtQueryInformationProcess, NtRemoveProcessDebug, DbgUiSetThreadDebugObject, DebugActiveProcess, CreateProcessW, NtDuplicateObject

Languages:
powershell, javascript

Links:
https://github.com/tc-hib/winres
https://github.com/hfiref0x/uacme