MIMICRAT
MIMICRAT (aka AstarionRAT) is a previously undocumented custom Windows remote access trojan (native MSVC x64 C/C++ implant) observed by Elastic Security Labs being delivered via ClickFix campaigns that abuse compromised legitimate websites. The infection chain uses a fake Cloudflare verification page (ClickFix lure) that instructs victims to copy/paste an obfuscated PowerShell command (e.g., via Win+R), initiating a multi-stage PowerShell sequence that performs ETW and AMSI bypasses, then drops/executes a Lua 5.4.7-based loader which decrypts and executes shellcode fully in memory. A Meterpreter-like shellcode stage reflectively loads the final MIMICRAT implant.
MIMICRAT communicates with C2 over HTTPS (port 443) using malleable HTTP(S) profiles designed to resemble legitimate web analytics traffic, with configuration stored in the .data section and runtime-decoded headers/URIs. Reported crypto includes RSA-1024 for session key exchange and AES with a hardcoded IV ("abcdefghijklmnop"). Post-exploitation capabilities include a 22-command dispatch table supporting process and file-system control, interactive shell access, token theft/impersonation, shellcode injection, and SOCKS5 proxy/tunneling.
Elastic assessed tactical/infrastructure overlaps with a Huntress-documented ClickFix campaign involving the Matanbuchus 3.0 loader, which Elastic assessed can also deliver MIMICRAT. The campaign appears opportunistic across geographies (Elastic cited victims including a USA-based university and Chinese-speaking users) and supports 17 languages with localization based on browser language settings. Researchers suspect the end goal is ransomware deployment or data exfiltration.
Noted delivery and C2 infrastructure/IOCs mentioned by Elastic include compromised sites bincheck[.]io (injected JS) and investonline[.]in hosting /js/jq.php; initial stage domain xmri[.]network (45.13.212.250) and related wexmri[.]cc; post-exploitation C2 www.ndibstersoft[.]com (23.227.202.114); CloudFront relay d15mawx0xveem1.cloudfront[.]net; S3 delivery backupdailyawss.s3.us-east-1.amazonaws[.]com/rgen.zip; and SHA-256 examples including Lua loader 5e0a30d8d91d5fd46da73f3e6555936233d870ac789ca7dd64c9d3cc74719f51 and a MIMICRAT beacon a508d0bb583dc6e5f97b6094f8f910b5b6f2b9d5528c04e4dee62c343fce6f4b.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
4 techniques
Execution
“Scheduled Task/Job” (listed in the report’s MITRE techniques section)
“Once the victim executes the clipboard command… an obfuscated PowerShell downloader contacts the C2 to retrieve a second-stage script…”
Persistence
1 technique
Persistence
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
3 techniques
Stealth
Discovery
2 techniques
Discovery
Command and Control
3 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
Other
2 techniques
Other
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
C++ remote access trojan delivered through ClickFix social-engineering style campaigns to establish remote control of victim machines.
Custom remote access trojan delivered via a ClickFix campaign using compromised legitimate websites (per the article title).
Custom remote access trojan delivered via ClickFix technique from compromised legitimate websites; described as mimicking C2 frameworks.
Custom C++ remote access trojan delivered via a multi-stage PowerShell chain (including ETW/AMSI bypass) and a Lua-based in-memory shellcode loader; communicates with C2 over HTTPS (port 443) using web-analytics-like HTTP profiles; supports token impersonation, interactive shell, process/file control, shellcode injection, and SOCKS5 tunneling.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.