{
  "source": "https://vojtechhron.dev/cs/article/psyduck",
  "title": "Psyduck - PowerShell RAT ",
  "exported_at": "2026-08-26T13:33:03.074Z",
  "indicators": [
    {
      "group": "Hashe",
      "type": "Fáze 1 (dropper) / SHA-256",
      "value": "feb46ecf8212f3d6d43afff5ff37558a97486ebea72059ea03b29b53f42ed23c"
    },
    {
      "group": "Hashe",
      "type": "Fáze 2 (Psyduck) / SHA-256",
      "value": "6f732fbbcbce8f4af84d65d6f016113819e3de4616e1b644b3d4c2086fdabe09"
    },
    {
      "group": "Síť",
      "type": "C2 doména",
      "value": "duck12.dynuddns.net"
    },
    {
      "group": "Síť",
      "type": "C2 port",
      "value": "1234"
    },
    {
      "group": "Síť",
      "type": "C2 protokol",
      "value": "HTTP"
    },
    {
      "group": "Síť",
      "type": "C2 endpoint",
      "value": "/Vre"
    },
    {
      "group": "Síť",
      "type": "C2 endpoint",
      "value": "/AW"
    },
    {
      "group": "Síť",
      "type": "C2 endpoint",
      "value": "/SS"
    },
    {
      "group": "Síť",
      "type": "C2 endpoint",
      "value": "/CF"
    },
    {
      "group": "Síť",
      "type": "C2 endpoint",
      "value": "/DF"
    },
    {
      "group": "Síť",
      "type": "C2 endpoint",
      "value": "/DR"
    },
    {
      "group": "Síť",
      "type": "Externí služba pro zjištění IP",
      "value": "https://icanhazip.com"
    },
    {
      "group": "Host",
      "type": "Dočasný vytvořený soubor",
      "value": "%TEMP%\\agent_1781054578.ps1"
    },
    {
      "group": "Host",
      "type": "Název uloženého spustitelného souboru",
      "value": "%TEMP%\\ce.exe (CK command)"
    },
    {
      "group": "Host",
      "type": "Název uloženého spustitelného souboru",
      "value": "%TEMP%\\update.exe (/DLF default)"
    },
    {
      "group": "Host",
      "type": "Název globálního mutexu",
      "value": "Global\\677d95b1-c2a4-4c21-a54f-874ddf08e8c9"
    },
    {
      "group": "Host",
      "type": "Prefix unikátního ID oběti",
      "value": "app_"
    },
    {
      "group": "Host",
      "type": "Oddělovač C2 příkazů",
      "value": "|V|"
    },
    {
      "group": "Host",
      "type": "Řetězec používaný pro maškarádu",
      "value": "Apex Monitoring Co Fleet Monitor Agent"
    },
    {
      "group": "Chování",
      "type": "Vzor User-Agent",
      "value": "app_<random>\\<hostname>\\<user>\\<OS>\\<AV>\\<UAC>\\<.NET>\\<exclusions>\\<window>"
    },
    {
      "group": "Chování",
      "type": "Parametr pro obejití Execution Policy",
      "value": "-ep bypass"
    },
    {
      "group": "Chování",
      "type": "Parametr skrytého spuštění",
      "value": "-WindowStyle Hidden"
    },
    {
      "group": "Chování",
      "type": "WMI namespace a třída",
      "value": "root/SecurityCenter2: AntiVirusProduct"
    },
    {
      "group": "Chování",
      "type": "Čtení registry klíče",
      "value": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System (ConsentPromptBehaviorAdmin)"
    }
  ]
}