Hackers Use Cross-Platform Noodle RAT to Secretly Control Windows and Linux Systems
AI summary · glm-5.3-flashSummaries by Vani AI
Check Point identifies Noodle RAT as a distinct cross-platform Windows/Linux backdoor used by Chinese-speaking actors against Asia-Pacific organizations since 2016.
Check Point assesses Noodle RAT, also known as ANGRYREBEL, as a distinct backdoor family rather than a variant of Gh0st RAT or Rekoobe, with separate Windows (Win.NOODLERAT) and Linux (Linux.NOODLERAT) variants sharing a common command-and-control design. The Windows implant runs filelessly via shellcode with loaders like MULTIDROP and MICROLOAD, while the Linux variant provides reverse shells, file management, and SOCKS tunneling after exploitation or web-shell placement on exposed servers. Groups including Iron Tiger, Calypso APT, Rocke, and Cloud Snooper have deployed it against organizations in Thailand, India, Japan, Malaysia, and Taiwan. Check Point released sample hashes and C2 IP indicators alongside the analysis.
Key facts
- Cross-platform backdoor with distinct Windows and Linux variants sharing a common C2 design
- Deployed by Iron Tiger, Calypso APT, Rocke, and Cloud Snooper against Asia-Pacific targets
- Initial access via malicious links, valid accounts, and exploitation or web shells on Linux servers
- Windows implant runs filelessly via shellcode; Linux variant offers reverse shell and SOCKS tunnels
- Check Point assesses Noodle RAT as a distinct family, not Gh0st RAT or Rekoobe
- ATT&CK
- T1566.002 Spearphishing LinkT1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1547.001 Registry Run Keys / Startup FolderT1053.005 Scheduled Task
- Vendors
- Check Point
- Products
- Noodle RATGh0st RATRekoobe
- Threat actors
- Iron TigerCalypso APTRockeCloud Snooper
- Malware
- Noodle RATMULTIDROPMICROLOAD
- Organizations
- Check Point
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | airuhuo.xyz | 8178b9dce62a482 Source-listed Noodle RAT sample hash Domain airuhuo.xyz Source-listed domain indicator IPv4 Address 64.118.132.233 |
| domain | shdufysuf.com | dress 64.118.132.233 Source-listed network indicator Domain shdufysuf.com Source-listed domain indicator IPv4 Address 191.223.42.34 S |
| ipv4 | 124.230.195.242 | 191.223.42.34 Source-listed network indicator IPv4 Address 124.230.195.242 Source-listed network indicator MD5 5b11b38bf0eb3f0952f306a |
| ipv4 | 137.220.158.91 | ss 8.210.93.39 Source-listed network indicator IPv4 Address 137.220.158.91 Source-listed network indicator MD5 ba2ff4a8b689fab54670cf8 |
| ipv4 | 191.223.42.34 | n shdufysuf.com Source-listed domain indicator IPv4 Address 191.223.42.34 Source-listed network indicator IPv4 Address 124.230.195.24 |
| ipv4 | 47.83.128.111 | bf79a65b9 Source-listed Noodle RAT sample hash IPv4 Address 47.83.128.111 Source-listed network indicator IPv4 Address 8.210.93.39 So |
| ipv4 | 58.181.61.142 | 75f843c29 Source-listed Noodle RAT sample hash IPv4 Address 58.181.61.142 Source-listed network indicator MD5 1a6dcfa8d4a429f5511ba3c |
| ipv4 | 64.118.132.233 | ain airuhuo.xyz Source-listed domain indicator IPv4 Address 64.118.132.233 Source-listed network indicator Domain shdufysuf.com Source |
| ipv4 | 8.210.93.39 | 47.83.128.111 Source-listed network indicator IPv4 Address 8.210.93.39 Source-listed network indicator IPv4 Address 137.220.158.91 |
| md5 | 1a6dcfa8d4a429f5511ba3cf83addabd | 4 Address 58.181.61.142 Source-listed network indicator MD5 1a6dcfa8d4a429f5511ba3cf83addabd Source-listed Noodle RAT sample hash SHA-1 d3cb5381f5743b53 |
| md5 | 1aa9416b733743f534abea90982dcd16 | 84500a84268792dca3 Source-listed Noodle RAT sample hash MD5 1aa9416b733743f534abea90982dcd16 Source-listed Noodle RAT sample hash SHA-1 5f283f5a5eb22bfe |
| md5 | 26f33ae36ad05582393a6d6ec6cb3273 | 90494d9ee72eece870 Source-listed Noodle RAT sample hash MD5 26f33ae36ad05582393a6d6ec6cb3273 Source-listed Noodle RAT sample hash SHA-1 313ebf27b9e1a2f1 |
| md5 | 3166ae39b46472d2ee53a880eb8248e0 | ebfe456974bb355bd2 Source-listed Noodle RAT sample hash MD5 3166ae39b46472d2ee53a880eb8248e0 Source-listed Noodle RAT sample hash SHA-1 974e94efa9515e53 |
| md5 | 3c230061e5a16cc559b0a7f025f08250 | 64b115a150d8dcf204 Source-listed Noodle RAT sample hash MD5 3c230061e5a16cc559b0a7f025f08250 Source-listed Noodle RAT sample hash SHA-256 4f4d405d32d76a |
| md5 | 5b11b38bf0eb3f0952f306ad5be9d5eb | Address 124.230.195.242 Source-listed network indicator MD5 5b11b38bf0eb3f0952f306ad5be9d5eb Source-listed Noodle RAT sample hash SHA-1 99fbd400260206d8 |
| md5 | 63af61806ff5060c77a526375f843c29 | 991195d1dbc7b8d82d Source-listed Noodle RAT sample hash MD5 63af61806ff5060c77a526375f843c29 Source-listed Noodle RAT sample hash IPv4 Address 58.181.61 |
| md5 | 832e5ff3482cd9e4fba4e2fe22799cd8 | 96b7452420a8fdd254 Source-listed Noodle RAT sample hash MD5 832e5ff3482cd9e4fba4e2fe22799cd8 Source-listed Noodle RAT sample hash SHA-1 ebda1aecbe1a9cf3 |
| md5 | 8d9fa801432654ebfe456974bb355bd2 | bbbe993b1ce8aea140 Source-listed Noodle RAT sample hash MD5 8d9fa801432654ebfe456974bb355bd2 Source-listed Noodle RAT sample hash MD5 3166ae39b46472d2ee |
| md5 | ba2ff4a8b689fab54670cf87b4008528 | Address 137.220.158.91 Source-listed network indicator MD5 ba2ff4a8b689fab54670cf87b4008528 Source-listed Noodle RAT sample hash SHA-1 dd0012a6ba2ffda2 |
| md5 | eff8675fac22c49107a2a42d3c735f10 | c29e8f916f0592575f Source-listed Noodle RAT sample hash MD5 eff8675fac22c49107a2a42d3c735f10 Source-listed Noodle RAT sample hash SHA-1 e17f76e0b4c47a5f |
| md5 | f070ad0d01de3696b7452420a8fdd254 | cae15d8b6b7d67e7e5 Source-listed Noodle RAT sample hash MD5 f070ad0d01de3696b7452420a8fdd254 Source-listed Noodle RAT sample hash MD5 832e5ff3482cd9e4fb |
| md5 | f1a04ffaa889c11b99b33610e4a87dec | 6f8aab98d4ae55eae4 Source-listed Noodle RAT sample hash MD5 f1a04ffaa889c11b99b33610e4a87dec Source-listed Noodle RAT sample hash SHA-1 199af4936e44ed89 |
| md5 | f2e641d14aaff8fa4872a157d9d1be82 | 7d2418b5a60f8525d7 Source-listed Noodle RAT sample hash MD5 f2e641d14aaff8fa4872a157d9d1be82 Source-listed Noodle RAT sample hash SHA-1 3a05ce5e3eea58d5 |
| sha1 | 199af4936e44ed894ea45b84500a84268792dca3 | 99b33610e4a87dec Source-listed Noodle RAT sample hash SHA-1 199af4936e44ed894ea45b84500a84268792dca3 Source-listed Noodle RAT sample hash MD5 1aa9416b733743f534 |
| sha1 | 313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7 | 393a6d6ec6cb3273 Source-listed Noodle RAT sample hash SHA-1 313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7 Source-listed Noodle RAT sample hash MD5 f2e641d14aaff8fa48 |
| sha1 | 3a05ce5e3eea58d50deb3d12d9f004486cd41efb | 4872a157d9d1be82 Source-listed Noodle RAT sample hash SHA-1 3a05ce5e3eea58d50deb3d12d9f004486cd41efb Source-listed Noodle RAT sample hash SHA-256 33641bfbbdd5a9 |
| sha1 | 5f283f5a5eb22bfeb153756a81728bf5d5c6ee71 | 34abea90982dcd16 Source-listed Noodle RAT sample hash SHA-1 5f283f5a5eb22bfeb153756a81728bf5d5c6ee71 Source-listed Noodle RAT sample hash SHA-256 df603ed55cbf6f |
| sha1 | 7436b37fae21f04841e667cae15d8b6b7d67e7e5 | a695628f467b6345 Source-listed Noodle RAT sample hash SHA-1 7436b37fae21f04841e667cae15d8b6b7d67e7e5 Source-listed Noodle RAT sample hash MD5 f070ad0d01de3696b7 |
| sha1 | 875108112d2fdfbdb04d75bbbe993b1ce8aea140 | 05be0dd29df50c7c Source-listed Noodle RAT sample hash SHA-1 875108112d2fdfbdb04d75bbbe993b1ce8aea140 Source-listed Noodle RAT sample hash MD5 8d9fa801432654ebfe |
| sha1 | 974e94efa9515e53d57b16f538c37bb9a81a39ee | ee53a880eb8248e0 Source-listed Noodle RAT sample hash SHA-1 974e94efa9515e53d57b16f538c37bb9a81a39ee Source-listed Noodle RAT sample hash SHA-1 fd4bf20350133d8f |
| sha1 | 99fbd400260206d8480d97d2a1f1b0de9c0bb44b | 52f306ad5be9d5eb Source-listed Noodle RAT sample hash SHA-1 99fbd400260206d8480d97d2a1f1b0de9c0bb44b Source-listed Noodle RAT sample hash SHA-256 a7632f145e45c8 |
| sha1 | ca114fe4812a708cd1d36320703beccc6fb927e2 | ors of compromise (IoCs):- Type Indicator Description SHA-1 ca114fe4812a708cd1d36320703beccc6fb927e2 Source-listed Noodle RAT sample hash SHA-256 668dcf124501c1 |
| sha1 | d3cb5381f5743b539630b4094214b44f623c650a | 511ba3cf83addabd Source-listed Noodle RAT sample hash SHA-1 d3cb5381f5743b539630b4094214b44f623c650a Source-listed Noodle RAT sample hash SHA-256 bd113d6b2cfba5 |
| sha1 | d6b243db1dbca54dace22f067d2e52938460410b | 43d96255eb2cdc24 Source-listed Noodle RAT sample hash SHA-1 d6b243db1dbca54dace22f067d2e52938460410b Source-listed Noodle RAT sample hash SHA-256 7aa50ba59b3849 |
| sha1 | dd0012a6ba2ffda25354d1a998178b9dce62a482 | 4670cf87b4008528 Source-listed Noodle RAT sample hash SHA-1 dd0012a6ba2ffda25354d1a998178b9dce62a482 Source-listed Noodle RAT sample hash Domain airuhuo.xyz Sou |
| sha1 | e17f76e0b4c47a5f54ca51b105be0dd29df50c7c | 07a2a42d3c735f10 Source-listed Noodle RAT sample hash SHA-1 e17f76e0b4c47a5f54ca51b105be0dd29df50c7c Source-listed Noodle RAT sample hash SHA-1 875108112d2fdfbd |
| sha1 | ebda1aecbe1a9cf37f2b0f1cf2adf827e0d0189d | fba4e2fe22799cd8 Source-listed Noodle RAT sample hash SHA-1 ebda1aecbe1a9cf37f2b0f1cf2adf827e0d0189d Source-listed Noodle RAT sample hash SHA-256 f25237d11c4d0a |
| sha1 | fd4bf20350133d8f8c12ed6047853571d89209df | 38c37bb9a81a39ee Source-listed Noodle RAT sample hash SHA-1 fd4bf20350133d8f8c12ed6047853571d89209df Source-listed Noodle RAT sample hash SHA-256 93b19bc56952ae |
| sha256 | 33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f | f004486cd41efb Source-listed Noodle RAT sample hash SHA-256 33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f Source-listed Noodle RAT sample hash MD5 eff8675fac22c49107 |
| sha256 | 4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4 | b0a7f025f08250 Source-listed Noodle RAT sample hash SHA-256 4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4 Source-listed Noodle RAT sample hash MD5 f1a04ffaa889c11b99 |
| sha256 | 51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9 | ba01a242f59327 Source-listed Noodle RAT sample hash SHA-256 51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9 Source-listed Noodle RAT sample hash IPv4 Address 47.83.128 |
| sha256 | 668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345 | 3beccc6fb927e2 Source-listed Noodle RAT sample hash SHA-256 668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345 Source-listed Noodle RAT sample hash SHA-1 7436b37fae21f048 |
| sha256 | 7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0 | 2e52938460410b Source-listed Noodle RAT sample hash SHA-256 7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0 Source-listed Noodle RAT sample hash SHA-256 7b63ddaf3b217f |
| sha256 | 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3 | f02d697b8e99d0 Source-listed Noodle RAT sample hash SHA-256 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3 Source-listed Noodle RAT sample hash Note: IP addresses and |
| sha256 | 93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204 | 853571d89209df Source-listed Noodle RAT sample hash SHA-256 93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204 Source-listed Noodle RAT sample hash MD5 3c230061e5a16cc559 |
| sha256 | a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144 | f1b0de9c0bb44b Source-listed Noodle RAT sample hash SHA-256 a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144 Source-listed Noodle RAT sample hash SHA-256 abf83c4d6bbf50 |
| sha256 | abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870 | 48e29186db1144 Source-listed Noodle RAT sample hash SHA-256 abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870 Source-listed Noodle RAT sample hash MD5 26f33ae36ad0558239 |
| sha256 | bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327 | 14b44f623c650a Source-listed Noodle RAT sample hash SHA-256 bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327 Source-listed Noodle RAT sample hash SHA-256 51aed28d3468de |
| sha256 | df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24 | 728bf5d5c6ee71 Source-listed Noodle RAT sample hash SHA-256 df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24 Source-listed Noodle RAT sample hash SHA-1 d6b243db1dbca54d |
| sha256 | f25237d11c4d0aa0224d20b7a4f7815dc4971102d2584e991195d1dbc7b8d82d | adf827e0d0189d Source-listed Noodle RAT sample hash SHA-256 f25237d11c4d0aa0224d20b7a4f7815dc4971102d2584e991195d1dbc7b8d82d Source-listed Noodle RAT sample hash MD5 63af61806ff5060c77 |
From the original article
5 min read at cybersecuritynews.com
Noodle RAT is a remote-access trojan that gives attackers control of compromised computers and servers. Its renewed visibility matters because it runs on both Windows and Linux, allowing one malware family to follow victims across corporate networks. The tool has appeared in operations against organisations across Asia-Pacific, including Thailand, India, Japan, Malaysia and Taiwan.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.