Researchers uncovered Kothamine Agent, an undocumented RAT linked to malicious npm packages that can control Windows systems, steal browser data, and capture audio/video on some builds. Recent variants use tailcat and earlier ones used Tailscale VPN, giving operators encrypted command access while avoiding a conventional C2 domain. #KothamineAgent #tailcat #Tailscale #npm
Keypoints
- Kothamine Agent is an undocumented remote-access Trojan that gives attackers broad control over infected Windows computers.
- The malware supports more than 30 commands for process control, file operations, shell execution, and loading additional DLL-based capabilities.
- Some builds include stealer functions that can collect browser data, cookies, gaming-related files, clipboard contents, and media from the camera and microphone.
- Kothamine is associated with malicious npm packages, putting users and developers who install those packages at risk.
- Recent versions use tailcat for encrypted command delivery, making traffic harder to inspect and removing the need for a traditional C2 domain.
- Earlier versions used the Tailscale VPN, and some builds also included a UAC bypass via fodhelper.exe plus additional persistence and Defender-exclusion steps.
- The campaign appears to have been active since at least July based on VirusTotal uploads and GitHub commits.
MITRE Techniques
- [T1055 ] Process Injection – The injector places the agent DLL into a running process, typically explorer.exe, to execute malicious code inside another process [‘injects the agent DLL into explorer.exe using OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA’]
- [T1543.001 ] Create or Modify System Process: Scheduled Task/Job – Persistence is established by creating a scheduled task that launches the copied injector at logon [‘creates a scheduled task to achieve persistence using the Injector executable’]
- [T1112 ] Modify Registry – The malware adds Windows Defender exclusions to reduce detection and protection [‘Add-MpPreference -ExclusionPath … Add-MpPreference -ExclusionProcess …’]
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – It weakens Microsoft Defender by excluding its files and process names from scanning [‘Adds Windows Defender exclusions using PowerShell’]
- [T1027 ] Obfuscated Files or Information – Newer versions hide strings by decrypting them inline or with XOR, making analysis harder [‘Recent versions decrypt strings inline or through functions that use XOR with a different key for each string’]
- [T1090 ] Proxy – The agent uses tailcat/Tailscale networking to relay commands through a local forwarded port to the operator node [‘This command makes tailcat server ports available as standard local TCP ports … and the requests are forwarded to the port 4444 of the operator’s node’]
- [T1071.001 ] Application Layer Protocol: Web Protocols – The malware downloads tools and dependencies from GitHub and the official Tailscale website [‘downloaded Tailscale files from the official Tailscale website or a GitHub repository’]
- [T1105 ] Ingress Tool Transfer – The agent obtains tailcat or Tailscale components from resources and external locations for use on the infected system [‘extracts tailcat from its resources and saves it as %ROAMING%TailscalePortabletailcat.exe’]
- [T1218.009 ] System Binary Proxy Execution: Regsvr32 – Not present
- [T1218.005 ] System Binary Proxy Execution: Mshta – Not present
- [T1548.002 ] Abuse Elevation Control Mechanism: Bypass User Account Control – Some builds use fodhelper.exe to elevate execution and run a PowerShell script [‘Some versions bypass User Account Control (UAC) using fodhelper.exe to run elevated.ps1’]
Indicators of Compromise
- [SHA-256 hash] Malware samples analyzed in the blog – ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0, 74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c
- [URL] GitHub repository used to distribute/download related executables and DLLs – https://github[.]com/cphc811-ui/
- [File name] Malware and loader filenames observed on disk – MicrosoftEdgeUpdateCore.exe, MicrosoftEdgeUpdateCore.dll
- [File name] Additional dropped or used components – tailcat.exe, up.ps1
- [Directory / path] Persistence and staging locations – %ROAMING%TailscalePortabletailcat.exe, C:WindowsTemp
- [Mutex] Agent single-instance lock – LocalKothamineAgentInstance
- [Command-and-control string / key material] Encrypted C2 key material used by the agent – mrowPsW2P5kzFGCNWeKAd+kYpo8Yy5c2pzaOSRuzisU=