AstarionRATMalware
- MIMICRAT
According to Huntress, AstarionRAT is a full-featured RAT with 24 commands, including credential theft, SOCKS5 proxy, port scanning, reflective code loading, and shell execution, with RSA-encrypted C2 communication disguised as application telemetry.From MISP Galaxy
Last reported 4 months ago, by Huntress3 reports
ATT&CK techniques
6 of 21 · each with the sentence it comes from- T1053.005Scheduled Task
“With AstarionRAT active on the initial endpoint, the operator established persistence via a scheduled task named Application Maintenance, configured to execute Core.exe from C:\ProgramData\2895e798a2579e6\.”
- T1055Process Injection
“Process Injection”
- T1620Reflective Code Loading
“Reflective Code Loading / In-Memory Execution”
- T1684Social Engineering
“…uary 2026, the Huntress Tactical Response team and SOC responded to a hands-on intrusion that began with a ClickFix infection, the social engineering technique that just won't die.”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Command Obfuscation”
- T1027.007Dynamic API Resolution
“The list below includes DLL names for dynamic API resolution, User-Agent strings, WQL queries, registry paths, format strings, and EDR process names used for security product detection:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Potemkin Loader & RMMProject The Anatomy of a ClickFix Attack“… in February involving lateral movement and the delivery of malware-as-a-service loader Matanbuchus and a novel custom implant called AstarionRAT.”
-
MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites“MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites”
-
A New RAT and a Hands-on-Keyboard Intrusion“… the intrusion we responded to, Matanbuchus delivered a RAT we had never seen before, a fully featured, custom implant we have dubbed AstarionRAT.”
Indicators in its reports
named in the reports above- www.ndibstersoft[.]comin 2 reports
- hxxps://cl.distritovagas[.]com/hte.htain 1 report
- cl.distritovagas[.]comin 1 report
- sonra.eutialyson[.]comin 1 report
- anus-staylard[.]xyzin 1 report
- pestrear-lamp[.]xyzin 1 report
- uglyshop-mare[.]xyzin 1 report
- rule-bead-dust[.]xyzin 1 report
- fair-bath-fond[.]xyzin 1 report
- 3b7ae925e2d64522…fafb69d881cein 1 report
- cd4e5e2c65b16604…3be9911ee145in 1 report
- hxxps://resumeacceptable[.]comin 1 report
- resumeacceptable[.]comin 1 report
- hxxp://127.0.0[.]1:31024in 1 report
- 198.41.200[.]63in 1 report
- 198.41.192[.]77in 1 report
- hxxp://77.110.122[.]58:23205/lQhEQui9a4lZ.exein 1 report
- 77.110.122[.]58in 1 report
- 213.165.41[.]26in 1 report
- hxxp://77.110.122[.]58:23205/cons_1.0.1.msiin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.