TL;DR
- PhantomProxyLite: Head Mare group component implemented as a PowerShell script for a persistent reverse SSH tunnel using the built-in ssh.exe, with dynamic configuration generation and storage of parameters in the HKLM\SOFTWARE\SSHService registry.
- Rutsstager: A stager that stores the full DLL content in the registry in hexadecimal format for delivering various payloads (including Orcus RAT).
- Steaelite RAT: A multifunctional tool combining credential theft, ransomware and DDoS with double extortion; a distinctive artifact is DESKTOP-*_cookies.zip zip files in the download folder on the desktop.
- Nopname: Ransomware that appends the .rams0n extension to encrypted files and leaves a README.txt ransom note; it particularly targets office documents, databases, virtual machines and backups.
1) PhantomProxyLite (Windows)
Sample: ANY.RUN
PhantomProxyLite is a component of the Head Mare group's toolkit designed to establish a reverse SSH tunnel from a compromised system to the command-and-control servers. The new implementation is written entirely in PowerShell and uses native Windows tools to create the tunnel and maintain persistence. The malware dynamically generates the SSH configuration, saves the parameters (port and settings) in the registry, and then launches ssh.exe, providing covert bidirectional access.
How it was detected
The malware was identified by the local artifact: the log file C:\Windows\Temp\SSHService.log.
Malware features
- Fully implemented in PowerShell without a separate executable binary.
- Creates an SSH tunnel to C2 using the standard ssh.exe client.
- Saves the configuration port and parameters in the Windows registry under the key HKLM\SOFTWARE\SSHService.
- Achieves persistence through a Windows Scheduled Task running with SYSTEM privileges.
- Uses a Living-off-the-Land approach — trusted system utilities and PowerShell.
Analytical notes
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-20 | News | 2026-03-03 | 3 |
The following TI Lookup query can be used to find recent public sandbox analyses.
TI Lookup:
filePath:"C:\\Windows\\Temp\\SSHService.log"
IOCs:
- SHA256:
2bb6c2a602ef3d610af41484900ec7f758704e0812b266c5d3afb20ff31cedab - FILE:
C:\Windows\Temp\SSHService.log
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1572 | Protocol Tunneling | Establishes SSH tunnel for C2 communication via ssh.exe. |
| T1204.002 | User Execution: Malicious File | Initial PowerShell script execution triggers setup. |
| T1562.001 | Impair Defenses: Disable or Modify Tools | Uses PowerShell to disable/alter detection and use native tools. |
| T1053.005 | Scheduled Task/Job: Scheduled Task | Creates scheduled task to run PowerShell on startup as SYSTEM. |
| T1112 | Modify Registry | Stores SSH configuration/port under HKLM\SOFTWARE\SSHService. |
| T1105 | Ingress Tool Transfer | Downloads/uses ssh.exe and config files for proxy/tunnel setup. |
| T1071.002 | Application Layer Protocol: SSH | Uses SSH protocol for bidirectional C2 communication. |
2) Rutsstager (Windows)
Sample: ANY.RUN
Rutsstager is a stager that delivers various types of payloads, including Orcus RAT. The DLL content is stored in the registry in hexadecimal representation, allowing transition to the main payload without writing additional files to disk.
How it was detected
Detected by monitoring anomalous activity related to file and registry behavior.
Malware features
- Uses a DLL to transition to the main payload.
- Stores DLL content in a registry value in hex format.
- Executes via Task Scheduler and can run as a Windows Service.
Analytical notes
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-26 | - | 2026-02-26 | 0 |
TI Lookup:
registryName:"^rutsdll32$"
IOCs:
- SHA256:
57ce6187be65c1c692a309c08457290ae74a0047304de6805dbb4feb89c0d7e5 - SHA256:
6a581c3b6fe7847bb327f5d76e05653a1504e51023454c41835e5dc48bc13ba4 - SHA256:
7d157366d74312965912a35cbba4187532cfeb3b803119a3a04c9ba0ba7d4ab0 - SHA256:
07f56ac8b5bd7cdb4c33ea5e9cd42bc7f9d3cd5504aabbb476ef010a142d7e29 - SHA256:
a6f72590792b3f26271736e5a7ba80102292546bb118cf84ff29df99341abfbe
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1053.005 | Scheduled Task/Job: Scheduled Task | The process executes via Task Scheduler |
| T1059.001 | Command and Scripting Interpreter: PowerShell | Starts POWERSHELL.EXE for commands execution |
| T1569.002 | System Services: Service Execution | Executes as Windows Service |
| T1497.003 | Virtualization/Sandbox Evasion: Time Based Checks | Performs time-based checks by reading system date to detect analysis environments |
3) Steaelite RAT (Windows)
Sample: ANY.RUN
Steaelite RAT is a multifunctional malware that combines data theft, ransomware, and DDoS attack capabilities within a single tool. It is distributed via phishing and vulnerability exploits and offers attackers a full-featured control panel.
How it was detected
By the creation or modification of files matching the pattern DESKTOP-*_cookies.zip.
Malware features
- Implements double extortion (theft + encryption with threat of data leak).
- Uses persistence via registry, masquerading, and fileless techniques.
Analytical notes
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-26 | News | 2026-03-03 | 2 |
TI Lookup:
filePath:"C:\\Users\\admin\\Desktop\\download\\DESKTOP-*_cookies.zip"
IOCs:
- SHA256:
b2a8d97da2a653de75d3d1be583910233a81a3794364e19ee4bc352b06b48f36 - DOMAIN:
1e81ea2a059f.ngrok-free.app
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1071.001 | Application Layer Protocol: Web Protocols | Use of HTTP/HTTPS for data exchange with the C2 server. |
| T1041 | Exfiltration Over Command and Control Channel | Transfer of stolen files through the C2 channel. |
| T1074.001 | Data Staged: Local Data Staging | Preparation and packaging of data before exfiltration. |
| T1547.001 | Boot or Logon Autostart Execution: Registry Run Keys | Registration in autostart via registry keys. |
| T1059.001 | Command and Scripting Interpreter: PowerShell | Use of PowerShell to execute commands and communicate with C2. |
| T1105 | Ingress Tool Transfer | Downloading additional malicious files from the C2 server. |
| T1083 | File and Directory Discovery | Exploring the file system to find data. |
4) Nopname (Windows)
Sample: ANY.RUN
Nopname is ransomware that encrypts user files on Windows systems, appending the .rams0n extension and leaving a README.txt ransom note. It uses a hybrid AES + RSA cryptosystem.
How it was detected
By the presence of files with the .rams0n extension.
Key facts:
- Artifacts: *.rams0n files.
- Encryption affects office documents, databases, virtual machines, and backups.
Analytical notes
| Detected | External sources | ANY.RUN Last Submission | Sandbox Evasion |
|---|---|---|---|
| 2026-02-27 | News | 2026-03-04 | 37 |
TI Lookup:
filePath:".rams0n$"
IOCs:
- FILE_EXT:
.rams0n - SHA256:
9dd027e5f02fb22c77217b8242009d6ed91a4b940a4cb08ef2d7532222961809 - SHA256:
aad9be3a5362b6916d55e47364b8f6a1e1a9804782f298ecc2883971d585dc77 - SHA256:
e78e452f35300128df9cc781c68b7e2b60468b431d89ed397bf70be116e60b45
MITRE:
| Technique ID | Technique Name | Evidence |
|---|---|---|
| T1486 | Data Encrypted for Impact | Mass file encryption with the addition of the .rams0n extension. |
| T1027 | Obfuscated Files or Information | Use of obfuscation. |
Conclusion
Fileless payload storage: Rutsstager places the entire next-stage DLL into a registry value in hexadecimal form, while PhantomProxyLite has switched to a fully PowerShell implementation.
Integration of legitimate Windows mechanisms: threats actively exploit Windows Scheduler for autostart. Particularly noteworthy is payload storage in the registry by Rutsstager and dynamic tunnel generation by PhantomProxyLite.
Combination of stealth and clear artifacts: the threats include many techniques for remaining unnoticed, but still leave obvious artifacts that allow threat attribution.