{
  "source": "https://vojtechhron.dev/en/article/psyduck",
  "title": "Psyduck - PowerShell RAT",
  "exported_at": "2026-08-26T13:33:34.836Z",
  "indicators": [
    {
      "group": "Hashes",
      "type": "Phase 1 (dropper) / SHA-256",
      "value": "feb46ecf8212f3d6d43afff5ff37558a97486ebea72059ea03b29b53f42ed23c"
    },
    {
      "group": "Hashes",
      "type": "Phase 2 (Psyduck) / SHA-256",
      "value": "6f732fbbcbce8f4af84d65d6f016113819e3de4616e1b644b3d4c2086fdabe09"
    },
    {
      "group": "Network",
      "type": "C2 domain",
      "value": "duck12.dynuddns.net"
    },
    {
      "group": "Network",
      "type": "C2 port",
      "value": "1234"
    },
    {
      "group": "Network",
      "type": "C2 protocol",
      "value": "HTTP"
    },
    {
      "group": "Network",
      "type": "C2 endpoint",
      "value": "/Vre"
    },
    {
      "group": "Network",
      "type": "C2 endpoint",
      "value": "/AW"
    },
    {
      "group": "Network",
      "type": "C2 endpoint",
      "value": "/SS"
    },
    {
      "group": "Network",
      "type": "C2 endpoint",
      "value": "/CF"
    },
    {
      "group": "Network",
      "type": "C2 endpoint",
      "value": "/DF"
    },
    {
      "group": "Network",
      "type": "C2 endpoint",
      "value": "/DR"
    },
    {
      "group": "Network",
      "type": "External IP lookup service",
      "value": "https://icanhazip.com"
    },
    {
      "group": "Host",
      "type": "Temporary created file",
      "value": "%TEMP%\\agent_1781054578.ps1"
    },
    {
      "group": "Host",
      "type": "Saved executable filename",
      "value": "%TEMP%\\ce.exe (CK command)"
    },
    {
      "group": "Host",
      "type": "Saved executable filename",
      "value": "%TEMP%\\update.exe (/DLF default)"
    },
    {
      "group": "Host",
      "type": "Global mutex name",
      "value": "Global\\677d95b1-c2a4-4c21-a54f-874ddf08e8c9"
    },
    {
      "group": "Host",
      "type": "Victim unique ID prefix",
      "value": "app_"
    },
    {
      "group": "Host",
      "type": "C2 command delimiter",
      "value": "|V|"
    },
    {
      "group": "Host",
      "type": "Masquerade string",
      "value": "Apex Monitoring Co Fleet Monitor Agent"
    },
    {
      "group": "Behavior",
      "type": "User-Agent pattern",
      "value": "app_<random>\\<hostname>\\<user>\\<OS>\\<AV>\\<UAC>\\<.NET>\\<exclusions>\\<window>"
    },
    {
      "group": "Behavior",
      "type": "Execution Policy bypass parameter",
      "value": "-ep bypass"
    },
    {
      "group": "Behavior",
      "type": "Hidden execution parameter",
      "value": "-WindowStyle Hidden"
    },
    {
      "group": "Behavior",
      "type": "WMI namespace and class",
      "value": "root/SecurityCenter2: AntiVirusProduct"
    },
    {
      "group": "Behavior",
      "type": "Registry key read",
      "value": "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System (ConsentPromptBehaviorAdmin)"
    }
  ]
}