Hackers Can Rent VectraRAT for $250 a Month to Take Control of Windows PCs
SOCRadar uncovered VectraRAT, a previously undocumented $250-per-month Windows RAT rental service delivered via Amadey and ClickFix lures.
SOCRadar's Threat Research Unit identified VectraRAT, a rental-only remote access trojan sold by a developer known as Vectra (formerly Nyxel), after an exposed online directory revealed samples, licenses, and operator logs across ten-plus servers. The toolkit includes a Linux control server, Windows implant, payload builder, and VectraHub panel, enabling hidden desktop access, keylogging, command execution, credential theft, file transfer, proxying, and silent privilege escalation. Of victims with OS data, 48 percent ran corporate Windows editions, and researchers recorded 38 genuine victim sessions in under a week, including file theft from business systems. Distribution occurs through the Amadey loader and ClickFix pages impersonating TurboTax, with custom TCP-based C2 over non-standard ports.
- Rental model includes control server, implant, payload builder, and support
- ClickFix lures instruct users to paste commands into Run or PowerShell
- Implant collects browser credentials, API keys, and database strings on connect
- Callback address can be changed post-install, complicating blocking
- Defenders urged to watch for PowerShell spawned after clipboard writes
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | verify-cloud.digital | distribution panel associated with the listed domain Domain verify-cloud.digital Domain resolving to the ClickFix distribution infrastructur |
| ipv4 | 178.16.54.148 | ving to the ClickFix distribution infrastructure IP address 178.16.54.148 ClickFix panel serving VectraRAT and NetSupport RAT IP addr |
| ipv4 | 195.20.115.77 | ckFix panel serving VectraRAT and NetSupport RAT IP address 195.20.115.77 Secondary VectraRAT cluster with exposed panel and director |
| ipv4 | 195.63.145.106 | madey panel and VectraRAT staging infrastructure IP address 195.63.145.106 Infrastructure sharing the VectraRAT communication port wit |
| ipv4 | 86.109.75.161 | rol server and operator panel; exposed directory IP address 86.109.75.161 ClickFix distribution panel associated with the listed doma |
| ipv4 | 86.109.75.168 | dcdfb3ef1ee07eb620 VectraRAT-related sample hash IP address 86.109.75.168 Primary command-and-control server and operator panel; expo |
| ipv4 | 91.219.236.179 | ctraRAT cluster with exposed panel and directory IP address 91.219.236.179 Related ServerAstra infrastructure IP address 91.92.242.236 |
| ipv4 | 91.92.242.236 | 1.219.236.179 Related ServerAstra infrastructure IP address 91.92.242.236 Amadey panel and VectraRAT staging infrastructure IP addres |
| sha256 | 3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7 | dac7c2bcc0904f066e0de VectraRAT-related sample hash SHA-256 3ab56c9fb6b7c404c1e5b36788959c877ea819fb124c3847fa0498e9915ef9a7 VectraRAT-related sample hash SHA-256 7b82f08120e0d9b16cd5b |
| sha256 | 7b82f08120e0d9b16cd5b9ec59d24fb68e35735c82311a233d370e7f264af650 | c3847fa0498e9915ef9a7 VectraRAT-related sample hash SHA-256 7b82f08120e0d9b16cd5b9ec59d24fb68e35735c82311a233d370e7f264af650 VectraRAT-related sample hash SHA-256 b738c03fef5e3d26419e4 |
| sha256 | 8745e872ff8aa41b0e03737f76bf35b6c934106c987dff98afe34120e47caf91 | 9ba4113f47bf2c9244dc5 VectraRAT-related sample hash SHA-256 8745e872ff8aa41b0e03737f76bf35b6c934106c987dff98afe34120e47caf91 VectraRAT-related sample hash SHA-256 bba58f99e14e3512c04a5 |
| sha256 | b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620 | 11a233d370e7f264af650 VectraRAT-related sample hash SHA-256 b738c03fef5e3d26419e4aab1818a0a7ad206c67fb3eeedcdfb3ef1ee07eb620 VectraRAT-related sample hash IP address 86.109.75.168 Prim |
| sha256 | b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e | d37b3377ae7b9acdcd0c9 VectraRAT-related sample hash SHA-256 b926cfcd3f4b07fe6001c39f46e40225ff8000411198d13782538d770c54ae5e VectraRAT-related sample hash SHA-256 bff3583d04f0d5603ced9 |
| sha256 | bba58f99e14e3512c04a5a74a079d7851abf935dd258cff4c80874ce7cfc82e3 | dff98afe34120e47caf91 VectraRAT-related sample hash SHA-256 bba58f99e14e3512c04a5a74a079d7851abf935dd258cff4c80874ce7cfc82e3 VectraRAT-related sample hash SHA-256 d8f15ba122cd6da01f83f |
| sha256 | bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5 | 8d13782538d770c54ae5e VectraRAT-related sample hash SHA-256 bff3583d04f0d5603ced9831eb7c45c1923bd90e2f7d5e5d2b32942d38cf6dc5 VectraRAT-related sample hash SHA-256 c708d413720848f8788f4 |
| sha256 | c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5 | d5e5d2b32942d38cf6dc5 VectraRAT-related sample hash SHA-256 c708d413720848f8788f43a4f47ddce016fca9af10c9ba4113f47bf2c9244dc5 VectraRAT-related sample hash SHA-256 8745e872ff8aa41b0e037 |
| sha256 | d8f15ba122cd6da01f83fe05294df80a6eadbce0f66dac7c2bcc0904f066e0de | 8cff4c80874ce7cfc82e3 VectraRAT-related sample hash SHA-256 d8f15ba122cd6da01f83fe05294df80a6eadbce0f66dac7c2bcc0904f066e0de VectraRAT-related sample hash SHA-256 3ab56c9fb6b7c404c1e5b |
| sha256 | ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9 | 25804fc4bc13f708d08ae VectraRAT-related sample hash SHA-256 ddbd636f6dfd475dc0c75bf9f6f873fa35b9062dee9d37b3377ae7b9acdcd0c9 VectraRAT-related sample hash SHA-256 b926cfcd3f4b07fe6001c |
| sha256 | dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae | bd35eb7c35ae6b844a0f0 VectraRAT-related sample hash SHA-256 dede8bfb55c2e6479d89b1e73e0712791cf16a7179325804fc4bc13f708d08ae VectraRAT-related sample hash SHA-256 ddbd636f6dfd475dc0c75 |
| sha256 | e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0 | s of Compromise (IoCs):- Type Indicator Description SHA-256 e2db5db12564d2a9da7ef3a57aa23d95782f5eaddc8bd35eb7c35ae6b844a0f0 VectraRAT-related sample hash SHA-256 dede8bfb55c2e6479d89b |
From the original article
4 min read at cybersecuritynews.com
Hackers can now rent a Windows-focused remote access tool called VectraRAT for $250 a month, lowering the barrier to deep and persistent compromise. The malware gives paying operators a way to watch victims, steal data, run commands, and move traffic through an infected computer. VectraRAT has surfaced as a rental-only malware service rather than a […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.