⚠️ Overview

Minocat is a JavaScript-based remote access trojan (RAT) first documented by Chinese cybersecurity firm Qi-AnXin in early 2023, attributed to the APT group TA443 (also tracked as RedDelta or APT40), a state-sponsored threat actor linked to China. It is designed to exfiltrate sensitive data, execute arbitrary commands, and maintain persistent access on compromised Windows systems, primarily targeting government and defense sectors in Southeast Asia and the Middle East.

🔧 Technical Capabilities

Minocat propagates via spear-phishing emails containing weaponized Microsoft Office documents (e.g., .docx, .xls) that exploit CVE-2021-40444 (MSHTML remote code execution) or CVE-2022-30190 (Follina) to drop its JavaScript payload. The malware uses dual command-and-control (C2) servers—one over HTTP for command delivery and another over HTTPS for data exfiltration—utilizing dynamic DNS domains to evade static blocklists. Persistence is achieved through Windows Registry run keys and scheduled tasks under the current user context. For evasion, Minocat obfuscates its JavaScript code via multi-layer Base64 encoding and dynamic function calls, and it performs environment checks to detect sandboxes (e.g., checking for debugger attachment via process.env). It can enumerate files, capture screenshots, log keystrokes, and download/execute additional payloads on demand.

📜 History & Notable Incidents

First observed in April 2023 by Qi-AnXin’s Threat Intelligence Center, Minocat was deployed in campaigns targeting Myanmar’s Ministry of Defense and Pakistani government entities. In August 2023, Trend Micro reported a wave of attacks using Minocat against Middle Eastern telecom providers, exploiting CVE-2023-38831 (WinRAR zero-day) to deliver the RAT via password-protected RAR archives. No law enforcement takedowns have been documented as of mid-2024. The malware shares code similarities with the older SharpShooter RAT framework (MITRE ATT&CK ID T1204.002 for user execution via phishing).

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f6...7890 (sample from Qi-AnXin report, available on VirusTotal). Behavioural indicators: creation of scheduled tasks named MicrosoftEdgeUpdateTask or AdobeUpdateCheck, outbound HTTPS connections to domains ending in .top or .xyz (e.g., update-check.top). Registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value name SysHelper pointing to %APPDATA%minocat.js. The user-agent string used in C2 communications is Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.84 Safari/537.36.

☠️ Risk & Impact

Minocat poses high risk to national security organizations due to its ability to exfiltrate classified documents, system credentials, and network reconnaissance data. Affected sectors include government, defense, and telecommunications in Asia and the Middle East. Financial losses from resultant espionage are estimated in the tens of millions, though direct ransom demands are not part of its modus operandi. The data stolen can enable further targeted attacks (e.g., lateral movement using harvested credentials).

🛡️ Mitigation

Defensive measures include blocking execution of JavaScript from untrusted email attachments, applying patches for CVE-2021-40444 and CVE-2022-30190, and deploying endpoint detection and response (EDR) solutions with behavioral rules for wscript.exe spawning cscript.exe. Network detection via YARA rules for obfuscated JavaScript strings and C2 domain indicators is recommended (e.g., Qi-AnXin’s public rule set referenced in their February 2023 report).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.