Affected Platforms: Microsoft Windows
Impacted Users: Windows Users
Impact: Full remote control of the victim’s computer
Severity Level: High

The FortiGuard Incident Response (FGIR) team recently investigated an intrusion involving SectopRAT, which was used to control the victim’s device.

SectopRAT (also known as ArechClient2) is a .NET-based remote access trojan (RAT) that provides a range of functions through multiple control commands. These include collecting sensitive data from the victim’s device, capturing screens, remotely managing processes and files, controlling bots, and other forms of remote device management.

In the incident I analyzed, the SectopRAT payload was concealed within a legitimate program developed by an Italian company with a long-standing digital audio workstation.

In this blog, I examine the techniques used to hide and extract the SectopRAT payload, the information it can collect, and the commands its server uses to remotely control the compromised device.

Analysis of the Malicious Folder

Figure 1 shows the folder containing the legitimate software and the malicious components. The folder contains an EXE file, two DB files, and several DLL files.

The SectopRAT payload is encrypted and embedded in the “pool.db” file. “ReportDump.exe” is a component of the legitimate software. Its name strongly suggests it is the crash and error reporting component. When it runs, it loads the necessary DLLs.

“sdkcra.dll” is the entry DLL for the malware that extracts the SectopRAT payload.

“ReportDump.exe” was configured as a scheduled task on the victim’s system, causing the Windows Task Scheduler to launch it automatically.

When “ReportDump.exe” launches, it loads “FrameworkBase.dll” by default. In the malicious sample, FrameworkBase.dll was tampered with to load the malicious “sdkcra.dll” by adding “sdkcra.dll” to the Import Address Table (IAT) of “FrameworkBase.dll”.

Figure 2 compares the IATs of FrameworkBase.dll from a normal installation with those from the tampered version in the malicious sample folder.

Based on these findings, this does not appear to be a supply chain attack. The evidence indicates that the legitimate software was tampered with by modifying FrameworkBase.dll and adding the malicious sdkcra.dll as an imported module.

In addition, we found the malicious folder under “C:\ProgramData”, which is not the software's normal installation directory.

So far, we have found no evidence that the vendor distributed a compromised version of the software.

“sdkcra.dll” Executes Encrypted ASM Code

When the “sdkcra.dll” entry point function is invoked, it creates a thread to execute one of its export functions, “IconUserUserDx()”.

This function performs the following tasks:

• The malware reads encrypted data from “Activation.Desktop.db” file using the SDL_IOFromFile() API, an exported function from SDL3.dll. The encrypted data starts at offset 0x36E93 in the “Activation.Desktop.db” file and is 0x533B3 bytes long.
• It then calls a decryption function to decrypt the data into ASM code, as shown in Figure 3.

• An export function, license(), from stp_aim_x64_vc15.dll is then invoked, passing the decrypted ASM code. During execution, license() calls the EnumSystemCodePagesW() API to execute the ASM code.

The lpCodePageEnumProc parameter of EnumSystemCodePagesW() is set to the address of the decrypted ASM code. This parameter is expected to point to a callback function that Windows invokes for each installed code page. By supplying the decrypted ASM code as the callback function, the malware abuses EnumSystemCodePagesW() to execute it.

Decrypted ASM Code to Decrypt the SectopRAT Payload

All APIs called in the ASM code are hidden and dynamically resolved at runtime using their corresponding API hash codes. In total, the malicious ASM code calls 187 such APIs.

Figure 4 shows how the ASM code retrieves the API HeapCreate(), one of the 187 APIs, by calling the 2BEF5CF() function. The API hash code is “0xD4F82AF2C9BFE9DC,” and the DLL module’s hash code is “0x6562B75966F9220.”

The ASM code initializes the .NET runtime environment by loading mscoreei.dll, clr.dll, and other required modules. Once the .NET runtime environment is initialized, the ASM code invokes the SectopRAT payload's entry-point method.

Dissecting the SectopRAT Payload

The Obfuscated SectopRAT Payload

The SectopRAT is heavily obfuscated. Its class, methods, and variables have been replaced with randomly generated names. It also uses control-flow flattening within its methods.

In addition, the malware uses the “calli” instruction throughout its .NET code. Unlike calling a normal method by name, it calls a method through a method pointer. This hinders analysts from performing reverse engineering. Figure 8 illustrates the obfuscation techniques explained above.

Obtaining the C2 Server Information

The malware’s C2 server information is encrypted and stored in the resource section. During initialization, the malware decrypts the C2 server’s IP address and port by calling a method with their corresponding indexes.

In this variant, the hardcoded C2 server’s IP address is “98.142.252[.]140,” and the TCP port is “15847.” Figure 9 shows the decrypted IP address.

SectopRAT then attempts to connect to the C2 server. If the C2 server is unavailable, the malware attempts to obtain an alternative C2 IP address by sending an HTTP POST request to one of 12 backup domains. The complete list of backup domains is provided in the IOCs section of this analysis.

Based on Google search results, these 12 backup domains appear relevant to Binance Coin (BNB) cryptomining. However, it’s unclear whether the attacker has compromised any of them. 

Figure 10 illustrates how a C2 server IP address is recovered from a backup domain’s HTTP response. The “result” key value is encoded as a hexadecimal string.

When the hexadecimal string is converted to ASCII, a Base64-encoded blob appears between the “START” and “FINISH” keywords. After Base64 decoding, the AES-encrypted IP address (56 26 … FF 31) is recovered. The malware then decrypts the data to recover the C2 server IP address.

The decrypted C2 server IP address in the response packet matches the hardcoded value.

SectopRAT Communication and Control Commands

After successfully connecting to the C2 server, SectopRAT begins communicating with it. The C2 server first sends a packet to SectopRAT, as shown in Figure 11. This packet is used as an example to examine the structure of SectopRAT’s packets.

All packets exchanged between the C2 server and SectopRAT are AES-encrypted.

• Packet size: The first 5 bytes of each packet, marked in red, contain a transformed value that represents the size of the encrypted data that follows. Use the following formula, where “data” points to the packet, to recover the actual size.

data[0]*100000000 + data[1]*1000000 + data[2]*10000 + data[3]*100 + data[4]

In this example, the five bytes are “00 00 00 01 5C”. Using the formula above, the result is 0+0+0+1*100+0x5C=0xC0. Therefore, the size of the data following the 5 bytes is 0xC0 bytes.

• IV: The next 10H bytes (8C EE … 3D 1B), highlighted in yellow, contain the IV used for AES decryption.
• Encrypted Command: The remaining data is the AES-encrypted payload.

The AES key used to encrypt and decrypt the packet is hardcoded in the SectopRAT payload.

After AES decryption, the plaintext data is in JSON format, as shown in Figure 12.

The value of the “Type” key specifies the control command. Figure 12 shows the decrypted control command packet for “InitMessage”.

Based on my analysis, this SectopRAT variant supports 29 control commands.

"UpdAllCvsmDebug", "ParticipantList", "BotURL", "StopCapture", "UnInstall", "CaptureRequest", "GetBrowserKeys", "ConnectToBot", "FileManager", "SessionID", "ShellJoinCommand", "InitMessageOld", "SetApp", "ProcessManager", "RestartBot", "InitMessage", "ControlInt", "RestartPC", "SendCookieFile", "ExportData", "SetColorDep", "EncryptionStatus", "FullscreenRequest", "InitOtherModules", "InitStealer", "ServerAfkSystem", "DeployBrowserKey", "LocalPluginInitModule" and "OneStartOneBlad".

Using these control commands, SectopRAT implements the following capabilities:

• Remote system administration
• Screen capture and remote-display control
• Browser credential and cookie theft
• Data exfiltration
• Process and file management
• Remote shell execution
• System reboot
• Bot management

Command “DeployBrowserKey” Steals Sensitive Data

When SectopRAT receives the “DeployBrowserKey” command from its C2 server, it begins collecting sensitive data from the compromised device. To assist SectopRAT in extracting data from web browsers, the malware downloads an additional module, named “WbElevation.dll”, from “hxxp://98.142.252[.]140:9000/wmglb”, which is decrypted from the resource at runtime.

This SectopRAT variant steals credentials, associated URLs, autofill data, saved credit card information, and web browser cookies. The malware also collects credentials from email clients and gaming applications. In addition, it targets certain cryptocurrency browser extensions and installed wallet software to steal wallet data.

The compromised software can be categorized as:

Web browsers:

Chromium, Google Chrome, ChromePlus, Iridium Browser, 7Star, Cent Browser, Chedot, Vivaldi, Kometa, Elements Browser, Epic Privacy Browser, Uran (uCozMedia), Uran, Sleipnir 5 (Chromium Viewer), Citrio, Coowon, Liebao Browser (Cheetah Browser), QIP Surf, Orbitum, Comodo Dragon, Amigo, Torch Browser, Yandex Browser, Comodo Browser, 360 Secure Browser, Maxthon 3, Sputnik Browser, Nichrome, Coc Coc Browser, Chromodo, Atom Browser (Mail.ru Atom), Brave Browser, Microsoft Edge, CryptoTab Browser, Mozilla Firefox, Waterfox, K-Meleon, Comodo IceDragon, Cyberfox, BlackHawk Browser, and Pale Moon.

Email clients:

Thunderbird

Browser extension wallets:

MetaMask, Chain Browser Wallet, TronLink, and Coinbase Wallet

Desktop wallet software:

Atomic Wallet, Exodus, Electrum, and Daedalus Mainnet

Others:

Battle.NET, Steam, and NVIDIA GeForce Experience

Figure 13 displays the credentials content just collected from the Microsoft Edge browser on the current analysis machine.

The following is an example of generated JSON data that contains the collected sensitive information.

{"Type":"ConnectionType",
"ConnectionType":"Client",
"SessionID":"A12BA3A3DCD70E02F89253C9EC78B11F",
"BotName":"win10(-)",
"BuildID":"gfh33",
"BotOS":"Microsoft Windows 10 Pro",
"URLData":"aHR0cHM6Ly9sb2dpbi5nb29nbGU [ … ] XVsdA0K",
"UIP":"NONE",
"BuildVersion":"103"}

• “ConnectionType” is the command name.
• “SessionID” indicates the current session.
• “BotName” contains the victim’s username.
• “BuildID” and “BuildVersion” contains the information of this SectopRAT Payload.
• “BotOS” contains information about the victim’s OS information,
• “URLData” contains a Base64-encoded string of the collected sensitive data from the victim’s machine.

After encrypting the entire JSON data using the AES algorithm, SectopRAT sends the encrypted data to the C2 server. Figure 14 shows an encrypted packet containing the collected sensitive data sent to the C2 server. The data size is 9*100 + 0x2C = 0x3B0.

Command “UnInstall” – Removes SectopRAT

Figure 15 shows how SectopRAT removes its executable file after the malware receives the “UnInstall” command. This command is classified as Bot management.

Based on the values contained in the “processStartInfo” object, SectopRAT executes the following command:

 cmd.exe /C choice /C Y /N /D Y /T 6 & Del {the full path of the current process}

The malware uses the “calli” instruction to invoke the method pointer for System.Diagnostics.Process Start(System.Diagnostics.ProcessStartInfo), passing the command in the parameter that executes the command.

The “choice” command introduces a six-second delay before the Del command runs. This allows the current SectopRAT process to terminate or otherwise release the executable file before attempting to delete it. After the six-second delay, the malware deletes the executable file in which SectopRAT is running.

Conclusion

This analysis of the SectopRAT variant demonstrates how attackers can hide a remote access trojan (RAT) to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls, and in-memory loading to execute the final .NET payload.

Once running, SectopRAT establishes encrypted communication with its C2 server, which supports 29 control commands for remote management of the compromised system. These capabilities include process and file management, screen capture, remote command execution, system reboot, and malware removal. The malware can also collect sensitive information from web browsers, email applications, gaming platforms, and cryptocurrency wallets.

Fortinet Protections

Fortinet customers are already protected from this campaign with FortiGuard’s Web Filtering and AntiVirus services as follows:

The URLs associated with this campaign are rated as Malicious Websites by the FortiGuard Web Filtering service.

FortiGuard Antivirus service detects the associated DLL files and DB files, as well as the fileless SectopRAT payload file, with the following AV signatures.

W64/SectopRAT.EDF4!tr
W64/SectopRAT.0846!tr
W64/SectopRAT.FD6A!tr
W64/ShellcodeRunner.BTO!tr

Fortinet FortiGate, FortiMail, FortiClient, and FortiEDR support the FortiGuard AntiVirus service, and each solution includes the FortiGuard AntiVirus engine. As a result, customers using these products already have up-to-date protections.

To stay informed of new and emerging threats, you can sign up to receive future alerts.

We also suggest that our readers complete the free NSE training: NSE 1 – Information Security Awareness, which includes information on Internet threats and is designed to help end users identify and protect themselves against phishing attacks.

The FortiPhish Phishing Simulation Service, together with Fortinet’s Security Awareness and Training Service, uses real-world phishing scenarios to train and test employees against common social engineering tactics. By improving users’ ability to recognize and respond to suspicious content—especially during high-risk periods of distraction or urgency—these services help reduce the risk of successful phishing and malware attacks.

If you believe this or any other cybersecurity threat has impacted your organization, please contact our Global FortiGuard Incident Response Team.

MITRE ATT&CK Techniques

IOCs

C2 Server IP Address & Port:

98.142.252[.]140:15847

Backup Domain List:

hxxps://bsc-dataseed1.binance[.]org/
hxxps://bsc-dataseed2.binance[.]org/
hxxps://bsc-dataseed3.binance[.]org/
hxxps://bsc-dataseed4.binance[.]org/
hxxps://bsc-dataseed1.defibit[.]io/
hxxps://bsc-dataseed2.defibit[.]io/
hxxps://bsc-dataseed3.defibit[.]io/
hxxps://bsc-dataseed4.defibit[.]io/
hxxps://bsc-dataseed1.ninicoin[.]io/
hxxps://bsc-dataseed2.ninicoin[.]io/
hxxps://bsc-dataseed3.ninicoin[.]io/
hxxps://bsc-dataseed4.ninicoin[.]io/

URLs:

hxxp://98.142.252[.]140:9000/wmglb

Relevant Sample SHA-256:

FrameworkBase.dll
48D3ECBB9E0B6BABE6E53E2082A076BAD07EF61CCD98DCC8B9E4F390B937788B

sdkcra.dll
37FCBCB21D16866784050682C58424C91D3A736F6FD599271FA6E53CF5CA8A92

Activation.Desktop.db
EFA07701570983909EF923EA79BB032F19FD9DAC0B819FA0E4F6B1161A4CC221

pool.db
95F6ABD3C43EF4B33CD61D054527233DD2CE705804D44A04BE96CFB73BB52E3A