/
← Voltar ao feed
high

SectopRAT variant hidden in legitimate software uses multi-stage loader, in-memory .NET payload and 29-command C2

1 fonte(s) · 1 atualização(ões) · publicado 24/09/2026 10:00 · coletado há 1 dia

FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C2 server, which supports 29 control commands. It can also collect sensitive data from web browsers, email applications, gaming platforms and cryptocurrency wallets. Fortinet states that its customers are already protected by Web Filtering and AntiVirus signatures.

Technical Details

  • The loader chain involves the DLLs FrameworkBase.dll and sdkcra.dll and the data files Activation.Desktop.db and pool.db. The final SectopRAT payload is fileless.
  • Execution relies on API hashing, indirect function calls and in-memory loading of the .NET payload.
  • The C2 supports 29 commands covering process and file management, screen capture, remote command execution, system reboot and malware removal.
  • For self-removal, the malware runs cmd.exe /C choice /C Y /N /D Y /T 6 & Del {full path of current process}. It invokes System.Diagnostics.Process.Start through the calli instruction. The six-second delay lets the process exit before the executable is deleted.
  • Listed C2 infrastructure includes bsc-dataseed[1-4] hosts on binance[.]org, defibit[.]io and ninicoin[.]io, plus hxxp://98.142.252[.]140:9000/wmglb.
  • Fortinet AV detections: W64/SectopRAT.EDF4!tr, W64/SectopRAT.0846!tr, W64/SectopRAT.FD6A!tr, W64/ShellcodeRunner.BTO!tr.

Remediation

  • Apply the FortiGuard Web Filtering and AntiVirus protections available in FortiGate, FortiMail, FortiClient and FortiEDR.
  • Block and hunt for the listed URLs, IP and file hashes.
  • Run phishing awareness training (Fortinet NSE 1, FortiPhish).
  • Contact an incident response team if compromise is suspected.

Linha do tempo

  1. feeds.fortinet.com ↗ · pub. 24/09/2026 10:00 · coletado 19/10 18:02 primeiro registro

    SectopRAT variant hidden in legitimate software uses multi-stage loader, in-memory .NET payload and 29-command C2

    ler a análise desta fonte

    FortiGuard Labs analyzed a SectopRAT variant that is embedded in legitimate software to evade detection. The malware uses a multi-stage loader to extract its payload from files, then applies API hashing, indirect function calls and in-memory loading to run the final .NET payload. Once running, it sets up encrypted communication with its C2 server, which supports 29 control commands. It can also collect sensitive data from web browsers, email applications, gaming platforms and cryptocurrency wallets. Fortinet states that its customers are already protected by Web Filtering and AntiVirus signatures.

    Technical Details

    • The loader chain involves the DLLs FrameworkBase.dll and sdkcra.dll and the data files Activation.Desktop.db and pool.db. The final SectopRAT payload is fileless.
    • Execution relies on API hashing, indirect function calls and in-memory loading of the .NET payload.
    • The C2 supports 29 commands covering process and file management, screen capture, remote command execution, system reboot and malware removal.
    • For self-removal, the malware runs cmd.exe /C choice /C Y /N /D Y /T 6 & Del {full path of current process}. It invokes System.Diagnostics.Process.Start through the calli instruction. The six-second delay lets the process exit before the executable is deleted.
    • Listed C2 infrastructure includes bsc-dataseed[1-4] hosts on binance[.]org, defibit[.]io and ninicoin[.]io, plus hxxp://98.142.252[.]140:9000/wmglb.
    • Fortinet AV detections: W64/SectopRAT.EDF4!tr, W64/SectopRAT.0846!tr, W64/SectopRAT.FD6A!tr, W64/ShellcodeRunner.BTO!tr.

    Remediation

    • Apply the FortiGuard Web Filtering and AntiVirus protections available in FortiGate, FortiMail, FortiClient and FortiEDR.
    • Block and hunt for the listed URLs, IP and file hashes.
    • Run phishing awareness training (Fortinet NSE 1, FortiPhish).
    • Contact an incident response team if compromise is suspected.