Fortinet discovers SectopRAT variant in trojanized Windows software

Key Takeaways

• A variant of SectopRAT malware has been discovered embedded within legitimate Windows software.
• The attack chain leverages modified application components and scheduled tasks to achieve persistent remote control and extensive data theft.
• The malware employs sophisticated evasion techniques, including multi-stage loading, encryption, and dynamic function resolution, to hide its presence.
• Victims face risks of stolen credentials from browsers, cryptocurrency wallets, and other applications, along with full system compromise.
• Fortinet recommends enhanced security awareness training and incident response protocols, as a patch for the tampered software is not applicable.

Fortinet Uncovers SectopRAT Variant in Trojanized Windows Software

Cybersecurity firm Fortinet has identified a new variant of SectopRAT, a potent remote access trojan, discreetly concealed within legitimate Windows software. This discovery highlights a persistent threat where attackers weaponize trusted applications to gain unauthorized control over infected systems and exfiltrate sensitive data.

The sophisticated intrusion method involved modifying legitimate application components, using encrypted files to mask the malware until it was loaded directly into memory. This approach allowed the malicious payload to evade detection by conventional security measures.

The compromised software originated from an Italian developer, widely recognized for a long-standing digital audio workstation. Attackers tampered with the application’s supporting files and configured a scheduled task to ensure automatic execution of the malware.

While the exact initial infection vector remains unclear, researchers from Fortinet’s FortiGuard Incident Response team uncovered the SectopRAT variant during an investigation of a compromised device. Fortinet said in a report that this particular malware combined a multi-stage loader with comprehensive capabilities for remote control and information theft.

SectopRAT, also known as ArechClient2, is a known malware family, not a newly emerged threat. Previous campaigns have seen it distributed via deceptive downloads facilitated by malicious search advertising.

This latest investigation from Fortinet documents a novel method of concealment for SectopRAT, distinct from earlier delivery mechanisms. It does not establish a direct link to prior campaigns or provide an estimate of wider infection rates.

Technical Analysis of the Infection Chain

The attack began with attackers altering a legitimate supporting library, specifically designed to import an additional malicious component when the application’s reporting executable was launched. This executable, named ReportDump.exe, was configured to run automatically by the Windows Task Scheduler, ensuring the tampered software could activate without continuous user interaction.

Investigators observed that the modified application folder was located outside its standard installation path, residing in C:ProgramData. Crucially, Fortinet found no evidence suggesting that the developer itself had distributed compromised software, indicating that the files were tampered with post-installation rather than through a supply chain breach. The initial malicious component, sdkcra.dll, was responsible for decrypting assembly code hidden within a database file named Activation.Desktop.db.

This decrypted code was then passed through another library, stp_aim_x64_vc15.dll, which abused a Windows callback function—typically used for processing system information—to execute the malicious instructions instead. This intermediate code dynamically resolved 187 Windows functions, keeping their names concealed until execution. The final SectopRAT payload, a 64-bit executable, was then decrypted from a second database file, pool.db, the .NET runtime was prepared, and the payload was launched directly into memory.

These sophisticated in-memory loading techniques, reminiscent of those seen in malware like Sauron Loader, utilize encryption, indirect calls, and multiple loading stages. This layered approach makes the working payload significantly harder to detect compared to a standalone malicious executable overtly present in an application directory.

The payload further complicated analysis by replacing readable code names with randomized identifiers and obfuscating its execution flow. These measures added significant hurdles for reverse engineers attempting to trace the malware’s logic and identify its functionalities. Frequent calls through method pointers further impeded analysis, making it challenging for security researchers to follow the malware’s operational sequence.

Remote Control and Data Exfiltration Capabilities

Upon successful activation, SectopRAT decrypted its command-and-control (C2) server address from embedded resources and attempted to establish a connection. If the primary connection failed, the malware possessed a fallback mechanism, contacting one of 12 backup endpoints to retrieve an alternative C2 address through a series of decoding and decryption steps.

Fortinet noted that these fallback endpoints appeared to be associated with Binance Coin infrastructure. However, the researchers emphasized that this observation does not confirm compromise of these services or imply participation by their operators in the intrusion. The use of these endpoints primarily serves as a resilient mechanism for the malware to maintain communication.

All communication between the SectopRAT instance and its C2 server was encrypted using AES. Fortinet identified 29 distinct commands supported by the malware, enabling extensive control over the infected device. These commands included screen capture, remote shell access, file and process management, system restarts, and other administrative functions, effectively granting attackers full control over the compromised machine.

A notable feature was a command to download an additional browser extraction module, WbElevation.dll. This module allowed the malware to collect a wide array of sensitive information, including saved passwords, associated website addresses, autofill records, payment card details, and browser cookies. Such browser credential theft campaigns underscore how a single infected device can compromise multiple valuable online accounts.

Beyond browsers, the malware targeted credentials from other applications, including Thunderbird, various gaming applications, wallet extensions, and desktop cryptocurrency wallets. The collected data was then structured, encrypted, and transmitted to the C2 server. The malware also included an uninstall command, capable of deleting its running executable after a six-second delay, likely to remove traces post-exfiltration.

Fortinet advises organizations to implement robust security awareness training to educate users on recognizing phishing attempts and other suspicious content. They also recommend seeking incident response assistance immediately if a compromise is suspected. While the published indicators of compromise (IoCs) provide valuable leads for investigation, the use of legitimate filenames and shared infrastructure necessitates careful contextual analysis rather than automatic assumptions of malicious ownership.

What You Should Do

• Implement Strong Endpoint Detection and Response (EDR): Utilize EDR solutions that can detect anomalous process behavior, in-memory execution, and unauthorized file modifications, which are key indicators of this variant.
• Enhance User Awareness Training: Educate employees on identifying and avoiding suspicious downloads, phishing emails, and malicious advertisements that could lead to the initial compromise of legitimate software.
• Regularly Monitor Scheduled Tasks: Periodically review scheduled tasks on Windows systems for any unauthorized or unusual entries that could be used for persistence by malware.
• Restrict Application Privileges: Enforce the principle of least privilege for all applications and user accounts to limit the potential damage if a system is compromised.
• Maintain Offline Backups: Ensure regular, encrypted backups of critical data are stored offline to mitigate the impact of data exfiltration or system compromise.
• Review Indicators of Compromise (IoCs): Integrate the provided IoCs (IPs, hashes, filenames, and directories) into your security information and event management (SIEM) and endpoint protection systems for proactive threat detection.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.