Noodle RAT: A Recipe for Cross Platform Espionage

    Friday, October 30, 2026 In: Threat Research Print

    Date: 10/30/2026

    Severity: High

    Summary

    Noodle RAT is a modular remote access trojan targeting both Windows and Linux systems. Active since at least 2016, it has been used by Chinese-speaking threat actors for espionage and cybercrime campaigns across the Asia-Pacific region, including India, Thailand, Japan, Malaysia, and Taiwan. Its capabilities include remote command execution, file transfer, reverse shells, and network tunneling. With encrypted C2 communications, shared code with other malware families, and an actively maintained toolkit, Noodle RAT represents a flexible cross-platform threat used by both state-aligned and financially motivated attackers. 

    Indicators of Compromise (IOC) List

    Domains/URLs

    airuhuo.xyz

    shdufysuf.com

    IP Address

    58.181.61.142

    47.83.128.111

    8.210.93.39

    137.220.158.91

    64.118.132.233

    191.223.42.34

    124.230.195.242

    Hash

    f070ad0d01de3696b7452420a8fdd254

    832e5ff3482cd9e4fba4e2fe22799cd8

    1a6dcfa8d4a429f5511ba3cf83addabd

    ba2ff4a8b689fab54670cf87b4008528

    5b11b38bf0eb3f0952f306ad5be9d5eb

    26f33ae36ad05582393a6d6ec6cb3273

    f2e641d14aaff8fa4872a157d9d1be82

    eff8675fac22c49107a2a42d3c735f10

    8d9fa801432654ebfe456974bb355bd2

    3166ae39b46472d2ee53a880eb8248e0

    3c230061e5a16cc559b0a7f025f08250

    f1a04ffaa889c11b99b33610e4a87dec

    1aa9416b733743f534abea90982dcd16

    63af61806ff5060c77a526375f843c29

    d6b243db1dbca54dace22f067d2e52938460410b

    199af4936e44ed894ea45b84500a84268792dca3

    5f283f5a5eb22bfeb153756a81728bf5d5c6ee71

    974e94efa9515e53d57b16f538c37bb9a81a39ee

    fd4bf20350133d8f8c12ed6047853571d89209df

    e17f76e0b4c47a5f54ca51b105be0dd29df50c7c

    875108112d2fdfbdb04d75bbbe993b1ce8aea140

    3a05ce5e3eea58d50deb3d12d9f004486cd41efb

    313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7

    99fbd400260206d8480d97d2a1f1b0de9c0bb44b

    dd0012a6ba2ffda25354d1a998178b9dce62a482

    d3cb5381f5743b539630b4094214b44f623c650a

    ebda1aecbe1a9cf37f2b0f1cf2adf827e0d0189d

    7436b37fae21f04841e667cae15d8b6b7d67e7e5

    ca114fe4812a708cd1d36320703beccc6fb927e2

    668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345

    7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0

    7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3

    df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24

    4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4

    93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204

    33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f

    a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144

    abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870

    bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327

    51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9

    f25237d11c4d0aa0224d20b7a4f7815dc4971102d2584e991195d1dbc7b8d82d

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "airuhuo.xyz" or url like "airuhuo.xyz" or siteurl like "airuhuo.xyz" or domainname like "shdufysuf.com" or url like "shdufysuf.com" or siteurl like "shdufysuf.com"

    Detection Query 2 :

    dstipaddress IN ("64.118.132.233","137.220.158.91","191.223.42.34","47.83.128.111","58.181.61.142","124.230.195.242","8.210.93.39") or srcipaddress IN ("64.118.132.233","137.220.158.91","191.223.42.34","47.83.128.111","58.181.61.142","124.230.195.242","8.210.93.39")

    Detection Query 3 :

    md5hash IN ("5b11b38bf0eb3f0952f306ad5be9d5eb","3c230061e5a16cc559b0a7f025f08250","8d9fa801432654ebfe456974bb355bd2","eff8675fac22c49107a2a42d3c735f10","f2e641d14aaff8fa4872a157d9d1be82","832e5ff3482cd9e4fba4e2fe22799cd8","f070ad0d01de3696b7452420a8fdd254","26f33ae36ad05582393a6d6ec6cb3273","3166ae39b46472d2ee53a880eb8248e0","1aa9416b733743f534abea90982dcd16","63af61806ff5060c77a526375f843c29","ba2ff4a8b689fab54670cf87b4008528","1a6dcfa8d4a429f5511ba3cf83addabd","f1a04ffaa889c11b99b33610e4a87dec")

    Detection Query 4 :

    sha1hash IN ("313ebf27b9e1a2f1a3b6457d2418b5a60f8525d7","7436b37fae21f04841e667cae15d8b6b7d67e7e5","974e94efa9515e53d57b16f538c37bb9a81a39ee","3a05ce5e3eea58d50deb3d12d9f004486cd41efb","dd0012a6ba2ffda25354d1a998178b9dce62a482","ca114fe4812a708cd1d36320703beccc6fb927e2","e17f76e0b4c47a5f54ca51b105be0dd29df50c7c","199af4936e44ed894ea45b84500a84268792dca3","99fbd400260206d8480d97d2a1f1b0de9c0bb44b","ebda1aecbe1a9cf37f2b0f1cf2adf827e0d0189d","fd4bf20350133d8f8c12ed6047853571d89209df","d6b243db1dbca54dace22f067d2e52938460410b","875108112d2fdfbdb04d75bbbe993b1ce8aea140","5f283f5a5eb22bfeb153756a81728bf5d5c6ee71","d3cb5381f5743b539630b4094214b44f623c650a")

    Detection Query 5 :

    sha256hash IN ("51aed28d3468de5e75addc467ba14389356afe896098e4e478efcd7bf79a65b9","668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345","4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4","df603ed55cbf6f9d74068b956ab966a7b785eb102e1045f343d96255eb2cdc24","93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204","f25237d11c4d0aa0224d20b7a4f7815dc4971102d2584e991195d1dbc7b8d82d","abf83c4d6bbf508504398ac56031c566ed662c3cc7e7b490494d9ee72eece870","7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3","bd113d6b2cfba5ab2780c313c01d87896c64f91376903efc62ba01a242f59327","7aa50ba59b38494cc524dbd31519bd3a218133aed64d9037eef02d697b8e99d0","a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144","33641bfbbdd5a9cd2320c61f65fe446a2226d8a48e3bd3c29e8f916f0592575f")

    Reference:    

    Noodle RAT: A Recipe for Cross Platform Espionage      


    Tags

    MalwareThreat ActorIndiaRATChinaCyber EspionageAsiaThailandJapanMalaysiaTaiwanRCEreverse shells

    « Previous Article

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.