rat
EtherRAT
A Node.js bot whose C2 address is resolved from an Ethereum contract (EtherHiding). Named by 1 report, 1 detection rule, 0 IOC feeds and 1 tracked actor.
Also written as: EtherRAT-class Node.js bot. These are the spellings the rules, feeds and profiles use; the page collects all of them.
Reports
Detection rules
YARA rules whose family metadata names this family, by detection page.
Detection rules
Sliver C2 Windows Post-Exploitation Staging, 193.233.202.17
EtherRAT_NodeJS_Bot_Config_TheGentlemen
Tracked actors
Designations whose profile lists this family as tooling.
- UTA-2026-024: Windows post-exploitation intrusion set with Sliver and a blockchain-resolved implant
A family name here is the label the linked rule, feed or profile carries, normalised to one spelling by _data/families.yml. Where a report declines to name a family, this page does not either.