[ALL_FAMILIES]

Atharvan

backdoor1 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:
Atharvan
CATEGORY:
BACKDOOR
DESCRIPTION:
Atharvan is a custom-developed remote access trojan (RAT) associated with the Clasiopa threat group, targeting materials research organizations in Asia. It uses a sophisticated HTTP-based C&C communication protocol with custom encryption, employs scheduled communication patterns, and includes commands for file download, arbitrary execution, and system configuration. The malware is named after a legendary Vedic sage and uses Hindi cultural references.
ALIASES:
AtharvanBackdoor
TAGS:
backdoorcustom_encryptionscheduled_communicationhttp_c2materials_research_targeting

[MUTEX_SIGNATURES](1)

[MUTEX_01]
SAPTARISHI-ATHARVAN-101
ANALYST: @adhikara13 DATE: 2025-07-30

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:
Clasiopa
FIRST_OBSERVED:
2023

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:1
THREAT_ACTORS:1
ALIASES:1
TAGS:5
CATEGORY:BACKDOOR
Malware profile loaded successfully

EvilMutex Project v1.0.0

Open Source Threat Intelligence Database