Kothamine RAT Uses Tailscale’s Tailcat for Encrypted Command Access
Summary
Researchers link Kothamine RAT to malicious npm packages. The Windows malware can control infected systems and steal data; recent versions use tailcat for encrypted command traffic, while earlier builds used Tailscale.
Key points
- Kothamine Agent is an undocumented Windows RAT linked to malicious npm packages, including dotnet-runtime-base.
- The analyzed malware injects its agent DLL, typically into explorer.exe, adds Windows Defender exclusions, and creates a scheduled task for persistence.
- Its 30-plus commands support process and file operations, shell execution, and loading additional DLL-based features.
- Some builds can steal browser data, cookies, gaming-related files, and clipboard contents, and capture screenshots or camera and microphone media.
- Recent versions use tailcat to relay encrypted commands without a conventional C2 domain; earlier versions used the Tailscale VPN.
- Some variants use fodhelper.exe for a UAC bypass. The researchers estimate activity or development dates back to at least July, based on VirusTotal uploads and GitHub commits.
- The article recommends checking npm package names, publishers, repositories, dependencies, and release history before installing.
Article Details
- Attack Vectors
- Malicious npm packages were linked to Kothamine Agent, exposing users and developers who install them to infection.
- The injector copies itself and an agent DLL into the user roaming directory, then injects the DLL into explorer.exe.
- Some builds use fodhelper.exe to bypass UAC and run an elevated PowerShell script.
- Recent versions use tailcat for encrypted command delivery; earlier versions used the Tailscale VPN.
- Operators can send commands to load additional DLL-based features.
- Defensive Notes
- Before installing an unfamiliar npm package, check its repository, maintainers, dependencies, release history, and reports of malicious activity.
- Verify package names carefully to avoid similarly named fake packages, and assess whether the publisher appears legitimate.
- Monitor for the named Kothamine files and scheduled task, tailcat/Tailscale components, Defender exclusion changes, and DLL injection into explorer.exe.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c | SHA-256 hash of the Kothamine Agent sample analyzed in the article. |
| SHA256 | ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0 | SHA-256 hash of the Kothamine Injector sample analyzed in the article. |
| URL | hxxps[:]//github[.]com/cphc811-ui/ | GitHub repository identified as a source for executables and DLLs associated with the malicious Kothamine package. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationRecent versions decrypt strings inline or with XOR-based functions.T1053.005 · Scheduled TaskThe up.ps1 script creates a scheduled task that launches the copied injector at logon.T1055 · Process InjectionKothamine Injector injects the agent DLL into a running process, typically explorer.exe, using OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, and LoadLibraryA.T1090 · ProxyThe agent uses tailcat forwarding to relay requests from a local TCP port to port 4444 on the operator's node.T1105 · Ingress Tool TransferThe agent extracts tailcat from its resources or downloads Tailscale components for use on the infected system.T1112 · Modify RegistryThe malware adds Windows Defender exclusions for paths and process names using Add-MpPreference.T1129 · Shared ModulesThe agent loads operator-supplied DLL features with LoadLibraryA and resolves their GetFeatureApi function.T1548.002 · Bypass User Account ControlSome builds use fodhelper.exe to bypass UAC and run elevated.ps1.T1562.001 · Disable or Modify ToolsKothamine weakens Microsoft Defender scanning by adding file and process exclusions.
Malware
Vendors
Products
tailcatRecent variants use tailcat and earlier ones used Tailscale VPN, giving operators encrypted command access while avoiding a conventional C2 domain.Tailscale VPNRecent variants use tailcat and earlier ones used Tailscale VPN, giving operators encrypted command access while avoiding a conventional C2 domain.Windows Defender[T1112 ] Modify Registry – The malware adds Windows Defender exclusions to reduce detection and protection [‘Add-MpPreference -ExclusionPath … Add-MpPreference -ExclusionProcess …’]