MYRA RAT Fileless memfd_create/fexecve Execution with Port 4444 C2

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects execution of processes originating from memory-only file descriptors (memfd) or the /proc/self/fd/ path, indicating fileless execution techniques often used by malware like MYRA RAT. This behavior is correlated with outbound network connections on port 4444 within a 2-minute window, which is indicative of command-and-control (C2) communication.