VectraRAT: A MaaS with Custom TCP C2 and UAC Bypass

1. Basic Information

• Original Title: VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch
• Source: SOCRadar STRU / Dark Reading
• Published Date: 2026-09-14
• Updated Date: None
• Severity: High
• Basis for Severity: SOCRadar identified 38 actual breach sessions from up to one week of C2 logs, confirming data theft via a total of 21 file transfers across 8 devices. 48% of victim entries with recorded OS information were enterprise Windows systems. It provides remote access, credential harvesting, and conditional UAC bypass.
• Original Link: VectraRAT: An Undocumented Full-Stack MaaS Built From Scratch
• Related Source: Dark Reading: VectraRAT Can Hack Windows Enterprises for $250 per Month
• Related Source: Microsoft: How User Account Control works
• Related Source: UACME: System Requirements
• Related Entities: VectraRAT, VectraHub, Amadey, Vidar, Vectra, Nyxel, Microsoft Windows, Windows Server 2025

2. Executive Summary

VectraRAT combines a Go-based management server with C++ Windows malware, distributed via ClickFix or Amadey. It features hidden desktop operation, credential harvesting, SOCKS5 proxy relay, and UAC bypass, rented starting at $250 per month.

3. Attack Flow

Flow 1: From ClickFix and Existing Malware to VectraRAT

1. An attacker tricks users into executing commands via a fake ClickFix authentication page, or deploys VectraRAT using existing malware like Amadey on compromised hosts.
2. The executed malware sets up a mutex and device identifier, then determines the C2 server from callback.json in the temp directory or embedded configuration.
3. It establishes custom TCP communication with VectraHub. Analyzed configurations show TCP/3308 in use.
4. Upon initial connection, it automatically collects browser credentials, network connection details, and configuration files.
5. The attacker can operate a hidden desktop, shell, file transfer, clipboard, and SOCKS5 relay. Implementation of each feature and its execution scope on individual victim endpoints must be distinguished.

Flow 2: UAC Bypass Logic Confirmed in Sample Analysis

1. Launches winver.exe as the target for debugging, obtains a handle to the debug object, and detaches from it.
2. Reuses that handle to launch the auto-elevating computerdefaults.exe as the debug target.
3. Obtains and duplicates the handle of the elevated process from debugging events.
4. Launches subsequent programs with computerdefaults.exe as the parent, inheriting a high-integrity-level token. This requires conditions such as an administrator account and UAC settings, and does not mean elevation is possible for all standard users.

4. Attacker Position and Execution Location

• The attacker operates an external VectraHub management console and C2 server.
• The malware on the infected endpoint runs on Windows. If UAC bypass succeeds, it can execute with a high integrity level.
• The SOCKS5 feature allows the infected endpoint to act as a communication relay point.

5. Perspective of Victims and Administrators

Victims

• ClickFix mimics authentication steps, tricking the user into pasting and running a command in the Run dialog.
• Because HVNC operates a separate desktop from the one displayed to the user, attacker activities may not appear on the screen.

Administrators

• Inference: Depending on configuration, indicators such as the LocalVectra.Client.SingleInstance mutex, callback.json in the temp directory, TCP/3308 connections, and suspicious parent-child relationships involving computerdefaults.exe may be observed.
• Inference: File access audits or EDR telemetry may show concentrated access to browser credentials and configuration files.

6. Conditions for Success and Failure

Success Conditions

• The program on the infected endpoint executes and successfully reaches the C2 server. ClickFix requires user command execution, while Amadey distribution requires prior compromise.
• The management server must operate with a valid license and return a response in the protocol format expected by the malware when it connects.
• UAC bypass assumes settings and an OS environment where auto-elevation can be abused from a non-elevated process in an administrator account. Referenced UACME also assumes administrator accounts with default UAC settings, and does not support elevation from standard users without admin credentials.

Failure Conditions

• Inference: Refusing to execute ClickFix commands or blocking execution via application control/EDR may prevent infection via this delivery vector. Alternative vectors like Amadey should also be investigated.
• Inference: Restricting communication to unauthorized C2 servers may stop remote control and data transfer. Since ports can change, blocking TCP/3308 alone does not guarantee safety.
• Inference: Operating as a standard user or reviewing UAC settings limits the abuse of auto-elevation, but does not necessarily prevent malware execution and information gathering in non-elevated states.

7. What Happens Upon Success

• Analyzed features include a remote shell, HVNC, keylogging, clipboard manipulation, file transfer, and SOCKS5 relay.
• Initial connection credential and configuration collection may impact services outside the endpoint.
• SOCRadar confirmed data theft via 21 total file transfers across 8 devices based on C2 logs. This does not report lateral movement across all victim endpoints.

8. Observable Logs

Email

• Inference: If delivered via email, check URLs and message bodies. The mere existence of a ClickFix page does not prove email was the distribution vector.

Proxy / SWG / DNS

• Inference: Check access to delivery infrastructure such as verify-cloud[.]digital and resolution/communication with known C2 servers. Custom TCP traffic may not appear in standard HTTP proxy logs.

Endpoint / EDR

• Inference: Check for mutexes, callback.json, winver.exe, computerdefaults.exe, and PowerShell/CMD parent-child processes. Verify debug APIs and integrity levels using supported product capabilities and configurations.

Identity / IdP

• Inference: Cross-reference the timeline of targeted endpoints with unauthorized logins to browser sessions, VPNs, and IdPs.

SaaS / Cloud

• Inference: Review audit logs for the use of cloud and API credentials stored in configuration files. The presence of files alone does not prove credential theft.

Network

• Inference: Examine custom TCP traffic and relay communications from the endpoint to the C2. Port 3308 is an observed C2 port, while ports 8080 and 8888 were used for the attacker's management console; these do not apply uniformly to all endpoint traffic conditions.

9. Attack Success Determination

Confirmed via Public Information

• Malware Execution or Authentication Success Confirmed: Public information: SOCRadar identified 38 actual breach sessions from up to one week of C2 logs. This count excludes scanners, Tor, and the attacker's own address ranges, and does not represent the total number of victims across all campaigns.
• Data Theft or Session Compromise Confirmed: Public information: SOCRadar confirmed data theft via 21 total file transfers from 8 victim endpoints. This is not "8 file transfers".

Organization-Specific Criteria

• User Action Confirmed: Criteria: Correlate access to the ClickFix page with subsequent command pasting and execution via endpoint logs. Public guidance steps alone do not confirm individual user actions.
• Initial Execution Confirmed: Criteria: Correlate process startup, executables, and C2 traffic on the target endpoint. Sample analysis alone does not confirm execution on a victim endpoint. UAC bypass requires separate verification of the executing user and privileges before/after elevation.
• Subsequent Compromise Confirmed: Criteria: Support with evidence such as unauthorized use of stolen credentials, connections to internal hosts, or additional malicious code execution. The mere presence of relay features does not constitute successful lateral movement.

10. Investigation Playbook

Triggers

• Inference: Start from suspicious mutexes, callback.json, TCP/3308 traffic, or abnormal child processes of computerdefaults.exe.

Initial Triage

• Inference: Check file hashes, executing user, integrity level, C2, and initial connection time.

Endpoint / Server

• Inference: Preserve process parent-child relationships, debug API logs (if available), access to credentials and configuration files, and traces of hidden desktops or SOCKS5 relays.

Authentication / Cloud

• Inference: Identify browser, VPN, IdP, and cloud/API credentials and sessions potentially exposed, and check for unauthorized use.

Subsequent Activity

• Inference: Track remote shells, file transfers, connections to relay targets, and additional malicious payloads.

Containment

• Inference: Isolate the endpoint from C2 traffic and revoke affected credentials/sessions. Determine whether to remove persistence or rebuild the endpoint after preserving evidence.

Decision Categories

• Inference: Distinguish between reaching landing pages, user interaction, malware execution, C2 connection, UAC bypass, data theft, and lateral movement.

11. Defense and Detection Ideas

Single Events

• Inference: Check for atypical parent-child relationships involving computerdefaults.exe, known mutexes, and callback.json in temp directories. Generic file names alone are inconclusive.

Timeline Correlation

• Inference: Correlate access to ClickFix, command execution, malware startup, C2 communication, credential/configuration file access, and data transfers. Track Amadey-based distribution via separate starting points.

Threat Hunting

• Inference: Use TCP/3308 and known indicators as starting points to investigate servers and developer endpoints for hidden desktops, relays, and mass access to configuration files.

Log Gaps

• Inference: If execution user, integrity level, file access, and payload details are unavailable, the scope of UAC bypass and data theft may remain undetermined.

Priority Mitigations

• Inference: Combine measures against ClickFix landing pages, unauthorized program execution control, outbound traffic restrictions, credential protection, and monitoring of privilege elevation.

12. Facts / Inference / Hypothesis

Facts

• VectraHub consists of a Go-based Linux server with an embedded Vue3 management console, while the infected endpoint side operates as a C++ Windows PE.
• The endpoint and management server use a custom protocol over TCP/3308 featuring a 5-byte header and MessagePack-formatted data.
• SOCRadar analyzed a mechanism that reuses the debug object of winver.exe to obtain a high-integrity token via auto-elevation and parent process assignment of computerdefaults.exe.
• Initial connection automatically collects browser credentials, network connection details, and .env, .conf, and .config files.
• From up to one week of C2 logs, 38 actual breach sessions were identified after excluding scanners, Tor, and attacker IP ranges. Confirmed data theft via file transfers occurred across 8 victim devices with a total of 21 file transfers. 48% of victim entries recording OS information were enterprise Windows.
• Observed distribution vectors include Amadey, ClickFix, and tax-themed file names. One ClickFix example masqueraded as TurboTax.

Inferences

• Fixed mutex names and TCP/3308 are useful but subject to change. Investigations must combine analysis of processes/APIs used for UAC bypass with credential and configuration file harvesting.
• SOCKS5 relay and hidden desktop operations can turn victim endpoints into stepping stones for further unauthorized actions. However, this does not imply lateral movement was observed on every victim endpoint.

Hypotheses

No additional hypotheses. Unconfirmed items are listed in "Unknowns and Further Investigation".

13. MITRE ATT&CK Mapping

• T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control (Confidence: high): Analyzed functionality leverages debug object reuse and auto-elevation of computerdefaults.exe.
• T1134.004 Access Token Manipulation: Parent PID Spoofing (Confidence: high): Specifies an elevated process as the parent to launch subsequent programs.
• T1555.003 Credentials from Web Browsers (Confidence: high): Harvests browser credentials upon initial connection.
• T1090 Proxy (Confidence: high): Includes functionality to turn infected endpoints into SOCKS5 relay points. This does not map to confirmed internal lateral movement.
• T1095 Non-Application Layer Protocol (Confidence: high): Uses custom binary TCP communication instead of HTTP.

14. Unknowns and Further Investigation

• Total victim counts per distribution vector and threat actor, and all pathways leading to ClickFix.
• Percentage of samples with enabled UAC bypass, and OS/account/UAC configurations across victim environments.
• Unauthorized use of credentials, lateral movement, and ultimate objectives within victim organizations.
• Nationality and locations of developers and operators.

15. Impact on SOCs and Organizations

Enterprise Windows systems and servers are included in the observation targets, meaning investigations focused solely on user endpoints may overlook impacts. However, 48% represents the proportion of victim entries with OS information within a limited C2 log set. Organizations should correlate executing users, pre- and post-elevation privileges, configuration file access, and subsequent identity/cloud usage to investigate information gathering even when UAC bypass does not succeed.

16. Summary by Role

• SOC: Correlate process parent-child relationships, integrity levels, C2 communication, and access to credentials/config files to distinguish execution, elevation, and theft.
• Administrators: Restrict unnecessary outbound traffic and unauthorized program execution, and review daily usage of administrator privileges. Revoke and reissue affected credentials and sessions.
• Users: Refuse requests from authentication pages to open the Run dialog and paste commands; report such incidents immediately.