Sectop RAT
Sectop RAT is a Windows remote access trojan also referred to in the provided reporting as ArechClient2. It has been observed as a follow-on payload in multiple malware delivery chains and is associated in the cited reporting with SmartApeSG, also tracked as ZPHP and HANEYMANEY. Prior SmartApeSG campaigns delivered Sectop RAT alongside other malware families including Remcos RAT, NetSupport RAT, and StealC.
The malware has been delivered through several infection vectors mentioned in the content. In SmartApeSG campaigns, victims were redirected from compromised websites to fake CAPTCHA or ClickFix pages and tricked into pasting attacker-provided commands into the Windows Run dialog, leading to staged delivery of multiple payloads. In one documented March 24, 2026 infection session, Sectop RAT was the fourth payload delivered after Remcos RAT, NetSupport RAT, and StealC, appearing about 1 hour and 18 minutes after StealC activity began. The content also describes a pirated-software lure in which a password-protected 7-zip archive delivered Lumma Stealer first, followed by Sectop RAT as a 64-bit DLL. Microsoft reporting in the content further notes that Storm-1113 and Storm-1674 activity involving malicious MSIX/App Installer delivery chains has included or likely dropped Sectop RAT.
Behaviorally, the content identifies Sectop RAT as a RAT deployed on Windows systems and, in observed campaigns, packaged for DLL side-loading or executed via rundll32. In the Lumma-followed-by-Sectop chain, the follow-on sample was a PE32+ 64-bit DLL retrieved from hxxps://enotsosun[.]pw/NetGui.dll, saved as C:\Users[username]\AppData\Local\Temp\16XBPQ29ZBG94TYNOA.dll, and executed with rundll32 [file path],LoadForm. In SmartApeSG reporting, Sectop RAT delivery archives used legitimate executables to side-load malicious DLLs. Rapid7 reporting cited in the content states earlier versions of the IDAT loader were disguised as a 7-Zip installer that delivered SecTop RAT.
Known network indicators in the provided content include command-and-control traffic to 91.92.241[.]102 over port 9000, including hxxp://91.92.241[.]102:9000/wmglb and hxxp://91.92.241[.]102:9000/wbinjget?q=66B553A8B94CE37C16F4EBC863D51FCC, as well as encoded or encrypted non-HTTPS traffic to 91.92.241[.]102 over TCP 443. Separate SmartApeSG reporting identifies 195.85.115[.]11:9000 as a Sectop RAT (ArechClient2) command-and-control server in a March 2026 campaign. A sample hash provided for a Sectop RAT DLL is d9b576eb6827f38e33eda037d2cda4261307511303254a8509eeb28048433b2f, and a Sectop RAT package hash from SmartApeSG reporting is c90435370728d48cba1c00d92cc3bf99e85f01aa52ecd6c6df2e8137db964796.
Overall, the provided content consistently places Sectop RAT as a Windows-focused second-stage or later-stage RAT used in financially motivated malware delivery ecosystems, commonly following social-engineering or malware-loader activity and often co-deployed with stealers and other RATs.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group has been linked to past campaigns that delivered dangerous tools including NetSupport RAT, Remcos RAT, StealC, and Sectop RAT.
The campaign, active as recently as March 24, 2026, delivered four separate malware payloads to a single infected host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT, also known as ArechClient2.
The campaign, active as recently as March 24, 2026, delivered four separate malware payloads to a single infected host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT, also known as ArechClient2.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
SmartApeSG works by injecting malicious scripts into legitimate but already-compromised websites. When a user visits one of these sites, they are redirected to a fake CAPTCHA page.
Execution
4 techniques
Execution
That command then pulled down a PowerShell script or HTML Application file, which installed a remote access tool or information stealer on the victim’s machine.
In this incident, the SmartApeSG injected JavaScript behaved as a staged loader, and did not attempt to execute every action immediately.
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
One of the more technically notable aspects of this campaign is how it hides harmful code inside packages that also contain legitimate software.
Collection
1 technique
Collection
Command and Control
4 techniques
Command and Control
Lumma Stealer command and control (C2) domains from Triage sandbox analysis... Example of Sectop RAT C2 traffic from an infected Windows host: hxxp[:]//91.92.241[.]102:9000/wmglb ... tcp[:]//91.92.241[.]102:443/ - encoded or otherwise encrypted traffic (not HTTPS/TLS)
IOCs tracked for this family
22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used to take control of a victim’s computer remotely.
A remote access trojan associated with prior SmartApeSG campaigns.
Remote access trojan deployed in prior SmartApeSG-linked campaigns as a follow-on payload.
A remote access trojan delivered as follow-up malware after Lumma Stealer infection, installed and executed via rundll32 using the exported function LoadForm, and communicating with command-and-control infrastructure over HTTP and TCP.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.