• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    MAL NodeInitRAT Script V1

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Aaron Mog@AaronMogS2S
    •updated Aug 18, 2025•1•0•19

    Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.

    YARA

    Tags

    T1059.007 - JavaScriptT1547.001 - Registry Run Keys / Startup FolderT1105 - Ingress Tool TransferT1071.001 - Web ProtocolsTA0002 - ExecutionTA0003 - PersistenceTA0004 - Privilege EscalationTA0011 - Command and ControlMalware DetectedFile EventWindowsCRIMERATBACKDOORNODEJSMOCHA_MANAKINFILE

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?