⚠
Atharvan
backdoor1 mutex signatures
[BASIC_INFORMATION]
FAMILY_NAME:
Atharvan
CATEGORY:
BACKDOOR
DESCRIPTION:
Atharvan is a custom-developed remote access trojan (RAT) associated with the Clasiopa threat group, targeting materials research organizations in Asia. It uses a sophisticated HTTP-based C&C communication protocol with custom encryption, employs scheduled communication patterns, and includes commands for file download, arbitrary execution, and system configuration. The malware is named after a legendary Vedic sage and uses Hindi cultural references.
ALIASES:
AtharvanBackdoor
TAGS:
backdoorcustom_encryptionscheduled_communicationhttp_c2materials_research_targeting
[MUTEX_SIGNATURES](1)
[MUTEX_01]
SAPTARISHI-ATHARVAN-101
ANALYST: @adhikara13 DATE: 2025-07-30
[QUICK_ACTIONS]
[THREAT_INTELLIGENCE]
ATTRIBUTION:
⚠Clasiopa
FIRST_OBSERVED:
2023
[SIGMA_RULE]
[STATISTICS]
MUTEX_COUNT:1
THREAT_ACTORS:1
ALIASES:1
TAGS:5
CATEGORY:BACKDOOR
Malware profile loaded successfully