Meow RAT macOS data staging and exfiltration to qwqerrqwr2145qw.com/gate

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•7

Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.