MASOL RAT
MASOL RAT is an HTTP-based remote access trojan/backdoor, also referred to as Backdr-NQ, observed in China-linked cyberespionage activity. It has been documented on Windows and was also reported as deployed on Linux devices, making it a cross-platform backdoor. High-confidence capabilities mentioned in the source material include backdoor access, arbitrary command execution, file download and upload, keylogging, configuration updates, and in-memory payload execution. One reported Windows sample communicated with command-and-control servers over HTTP POST using AES encryption and contained the PDB path E:\Masol_https190228\x64\Release\Masol.pdb. In the 2025 Southeast Asian government intrusion investigated by Palo Alto Networks Unit 42, MASOL RAT was used by cluster CL-STA-1048 alongside EggStremeFuel, EggStreme Loader/Gorem RAT, and TrackBak Stealer to support long-term persistence and data theft. Unit 42 detected a MASOL RAT sample at C:\Windows\System32\AxInstSVs.dll with SHA256 05995284b59ad0066350f43517382228f7eee63cd297e787b2a271f69ecf2dfc. The malware has been publicly associated with activity overlapping Earth Estries and Crimson Palace, and reporting states Earth Estries deployed MASOL RAT against Southeast Asian government networks, including Linux devices. The broader targeting described in the content centers on government networks in Southeast Asia, with Earth Estries also linked more broadly to telecommunications and government targeting.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Attackers deployed numerous malware families, including HIUPAN, PUBLOAD, EggStremeFuel, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis Loader, and FluffyGh0st.
Attackers deployed numerous malware families, including HIUPAN, PUBLOAD, EggStremeFuel, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis Loader, and FluffyGh0st.
Attackers deployed numerous malware families, including HIUPAN, PUBLOAD, EggStremeFuel, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis Loader, and FluffyGh0st.
Masol RAT and EggStreme Loader provided backdoor access, keylogging, and in-memory payload execution, while TrackBak stole keystrokes, clipboard data, and network info.
Masol RAT and EggStreme Loader provided backdoor access, keylogging, and in-memory payload execution, while TrackBak stole keystrokes, clipboard data, and network info.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 techniqueMASOL RAT (aka Backdr-NQ), a remote access trojan with file download/upload and arbitrary command execution features.
Stealth
1 techniqueusing ClaimLoader to decrypt and execute shellcode in memory... Masol RAT and EggStreme Loader provided backdoor access, keylogging, and in-memory payload execution
Credential Access
1 techniqueCollection
1 techniqueCommand and Control
3 techniquesVariants of PUBLOAD use either HTTP or TCP for command-and-control (C2) communications. The sample we observed is a variant that uses TCP... Masol RAT... communicates with its C2 servers over HTTP POST... This malware uses Google Remote Procedure Call (gRPC) for C2 communication.
EggStremeFuel, a lightweight backdoor that's equipped to download/upload files... EggStremeLoader... supports 59 backdoor commands... This includes a variant that facilitates file download/upload over Dropbox. MASOL RAT... with file download/upload... COOLCLIENT... supports file download/upload.
Masol RAT and EggStreme Loader provided backdoor access... FluffyGh0st... enables remote control and plugin-based functionality
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used in the campaign to provide persistent access to compromised systems.
A remote access trojan that provides backdoor access, keylogging, and in-memory payload execution.
Remote access trojan with file download/upload and arbitrary command execution capabilities.
HTTP-based Windows backdoor designed to run as a service DLL. It communicates with C2 over AES-encrypted HTTP POST and supports arbitrary command execution, C2 configuration management, and file upload/download.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.