Loading malware…
ArechClient2, also known as SectopRAT, is a heavily obfuscated .NET remote access trojan with integrated information-stealing functionality that has been publicly reported since 2019. It targets Windows systems and combines remote control, system profiling, credential and wallet theft, and multiple defense-evasion features. Reported capabilities include collection of browser passwords, cookies, autofill data, cryptocurrency wallet data, and credentials from applications such as FTP, VPN, Telegram, Discord, and Steam, along with host reconnaissance such as operating system, hardware, machine identity, IP, and geolocation. It has also been noted for a hidden secondary desktop feature that enables operator interaction with the victim system while reducing user visibility.
ArechClient2 is commonly delivered as a follow-on payload by loaders and multi-stage intrusion chains rather than as a standalone first-stage implant. Reported delivery ecosystems include HijackLoader, FakeBat, Amadey, GHOSTPULSE-related chains, and malicious MSIX packages. Initial access patterns associated with these chains include malvertising, SEO poisoning, typosquatted or fake software download pages, phishing lures, and ClickFix-style paste-and-run social engineering. Campaigns have impersonated legitimate software and services, and some activity has specifically targeted transportation and logistics organizations in North America, while other campaigns were broader and opportunistic across industries. Additional reporting has described phishing aimed at content creators and sponsorship-themed lures.
The malware is associated with strong defense evasion and in-memory execution tradecraft. Observed chains have used process injection or hollowing into legitimate Windows processes, AMSI bypassing in intermediate loaders, anti-VM and anti-emulator checks, and checks for security products before continuing execution. ArechClient2 is frequently loaded reflectively or directly into memory by intermediate .NET loaders, complicating static analysis and detection.
Its command-and-control tradecraft has evolved over time. In addition to hardcoded or externally retrieved infrastructure, ArechClient2 has been observed obtaining secondary command-and-control information from public services and, more recently, via EtherHiding techniques that query smart contracts on the Binance Smart Chain and decrypt returned configuration data. This use of blockchain-based dead-drop resolution improves resilience against takedown and simple indicator blocking.
ArechClient2 has appeared in financially motivated intrusion activity and has been observed in ecosystems that also deliver other stealers and post-compromise tooling. Public reporting has linked it to campaigns preceding broader criminal operations, including delivery chains associated with Cobalt Strike, Brute Ratel, and ransomware deployment. Its combination of RAT functionality, credential theft, wallet theft, stealth features, and flexible delivery through commodity loaders makes it a persistent threat in Windows-focused cybercrime operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
ClearFake has delivered multiple payloads over time, including ArechClient2 and LummaC2; most recently, we’ve observed ACR Stealer, which debuts in this month’s top 10.
If allowed to continue running beyond this stage, researchers have reported additional payloads including StealC and ArechClient2.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
This advisory is issued to raise awareness of a malvertising campaign, dubbed FakeAgent, which uses malicious Bing search ads...
you will see there are quite a lot of words and patterns belonging to cryptocurrencies and the crypto ökosystem... All with some sort of Typosquatting. This smelled phishy.
the sample is probably shared through one of the many Google Ads Campaigns which are currently ongoing, where threat actors register malicious websites, make them appear like official software pages, and then lure victims into downloading malicious software.
Persistence on the system is achieved through another executable named DockerDesktop.exe, which installs a scheduled task.
The outcome? A perfectly valid PE file... proves to be a legitimate AutoIT3 executable... After that, “Champion.exe.pif” executes “S”.
note the TCP Port 15647 and the “PowerShell get-process” calls for “avastui” and “avgui”.
shortly after we see a command-line task started with “cmd.exe /c cmd < 4”... after deobfuscating this, we get the following lines of cmd commands
Upon opening it, we are greeted by tons of gibberish... most of it is trash code, which is included to confuse... The script had 10255 lines in this style... the binary was strongly obfuscated using flow-dependent mutations and flow-dependent variables
Polymorphic Junk Code SHELLTER-protected samples commonly employ self-modifying shellcode with polymorphic obfuscation to embed themselves within legitimate programs. This combination of legitimate instructions and polymorphic code helps these files evade static detection and signatures, allowing them to remain undetected.
the Execution Parent of our Sample is actually a file called “obs-installer-setupx64–29.685.zip”... threat actors register malicious websites, make them appear like official software pages
Suspicious behaviors by a cmd.exe-created process that Arechclient2 is injected into, for example msbuild.exe
This did give further proof of a possible process injection through Process Hollowing: As initially expected, the AutoIT script injected some code into the legitimate “jsc.exe”.
SHELLTER encrypts its final, user-defined payloads using AES-128 CBC mode... In Shellter Elite v11.0, by default, payloads are compressed using the LZNT1 algorithm before being encrypted.
Additionally, it has several anti-VM and anti-emulator capabilities.
The first thing that comes to the eye is the search for processes called “avastui” and “avgui” using the PowerShell get-process scriptlet.
From the function names and some other artifacts, it's clear that we are looking at a Credential Stealer. It fingerprints the system and then steals as much sensitive data as possible.
We also see the creation of a TCP Client, which is used for C2 Communication... Prior Analysis of this threat has shown very similar TTP: A connection via TCP/IP, a Connection to Port 15647, JSON-based communication
Besides, the script was also responsible for the initial DNS Query that was observed.
By following the “verification steps,” the user inadvertently runs the command and additional commands will reach out and download malware or tools.
195 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware that uses EtherHiding to pull C2 configuration from a smart contract, using AES decryption with a hardcoded key and embedded smart contract data.
An additional payload reportedly delivered in later stages of Scarlet Goldfinch activity.
Named malware/tool delivered via paste-and-run campaigns.
Payload delivered by malicious MSIX packages in activity consistent with FakeBat operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.