███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

Netdooka

rat1 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

Netdooka

CATEGORY:

RAT

DESCRIPTION:

Netdooka is a Remote Access Trojan (RAT) framework that has been observed being distributed via PrivateLoader PPI (Pay-Per-Install) services. The malware is designed to provide remote access to compromised systems and has been analyzed for its sophisticated evasion techniques and multi-stage attack capabilities.

ALIASES:

Netdooka RAT

TAGS:

remote_accessframeworkprivateloaderppimulti_stageevasion_techniques

[MUTEX_SIGNATURES](1)

[MUTEX_01]

3f0d73e2-4b8e-4539-90fd-812330bb39c8

ANALYST: @adhikara13 DATE: 2024-07-16

REFERENCES:

https://www.trendmicro.com/en_se/research/22/e/netdooka-framework-distributed-via-privateloader-ppi.html

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2022

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:1

THREAT_ACTORS:1

ALIASES:1

TAGS:6

CATEGORY:RAT

Malware profile loaded successfully