SectopRAT

MITRE ATT&CK Mapping Tactic Technique ID Notes Resource Development Acquire Infrastructure: Domains T1583.001 casyetnx[.]pw via CNOBIN, hosting via dataforest/VDSINA

MITRE ATT&CK Mapping ... Resource Development Compromise Infrastructure T1584.004 Compromised acecareer.edu WordPress for payload hosting

ClearFake spreads by compromising legitimate websites and injecting hidden JavaScript code into their pages. Victims do not need to do anything suspicious to get infected. Simply visiting a tampered legitimate site can trigger the malware’s multi-stage delivery chain.

Despite the .php extension, this is pure PowerShell... The actual payload mechanism is straightforward... After decryption, the result is a valid PE32 .NET assembly loaded directly into memory.

Stage 3 -- Legitimate Python Binary : The ZIP extracts to a directory containing FNPLicensingService.exe -- which is actually a renamed, legitimately signed CPython 3.15 pythonw.exe... Stage 4 -- Obfuscated Python Loader : chrome_100_percent.pak ... is an ASCII text file containing obfuscated Python code.

After decryption, the loader allocates executable memory via NtAllocateVirtualMemory, writes the shellcode, and creates a new thread with NtCreateThreadEx. Both calls go directly to NTDLL, bypassing the Win32 API layer where most EDR products place their hooks.

Windows users were instructed to open the Run dialog and paste it, loading a remote DLL into memory with no file ever written to disk.

The user copies and pastes a PowerShell command into their own terminal, bypassing email security gateways, browser sandboxes, and most EDR behavioral triggers that watch for automated script execution.

MITRE ATT&CK Mapping ... Persistence Boot or Logon Autostart T1547 SectopRAT standard persistence

DataUpdateClient.exe... Injects via NtAllocateVirtualMemory + NtCreateThreadEx... MITRE ATT&CK Mapping... T1055 Donut shellcode injection via NTDLL syscalls.

Rather than the standard CreateThread or NtCreateThreadEx injection techniques... the loader uses Windows Fibers: VirtualAlloc(RWX) ... ConvertThreadToFiber(0) ... CreateFiber(0, addr, 0) ... SwitchToFiber(fiber)

MITRE ATT&CK Mapping ... Persistence Boot or Logon Autostart T1547 SectopRAT standard persistence

Each stage exists to defeat a different class of defense... the XOR and AES layers defeat static analysis... MITRE ATT&CK Mapping... T1027 Three-layer encryption (XOR, AES-256-CBC, Chaskey).

MITRE ATT&CK Mapping ... Defense Evasion Software Packing T1027.002 Reversed Base64 + Zlib compression

MITRE ATT&CK Mapping ... Defense Evasion Masquerading T1036.005 FNPLicensingService.exe (renamed pythonw.exe)

DataUpdateClient.exe... Injects via NtAllocateVirtualMemory + NtCreateThreadEx... MITRE ATT&CK Mapping... T1055 Donut shellcode injection via NTDLL syscalls.

Rather than the standard CreateThread or NtCreateThreadEx injection techniques... the loader uses Windows Fibers: VirtualAlloc(RWX) ... ConvertThreadToFiber(0) ... CreateFiber(0, addr, 0) ... SwitchToFiber(fiber)

The chrome_100_percent.pak file decodes through three distinct layers... reverse string, base64 decode, zlib decompress ... rolling XOR decrypts embedded SectopRAT PE

Architecture gate: Forces relaunch in 32-bit PowerShell via $env:WINDIR\SysWOW64\WindowsPowerShell\v1.0\powershell.exe... MITRE ATT&CK Mapping... T1218 32-bit PowerShell relaunch via SysWOW64.

Four contracts served distinct roles: Smart Contract A delivered the anti-analysis dispatcher...

Victims on Windows and macOS were routed to separate payloads tailored to their operating system, with routing handled by real-time OS detection in the browser.

After decryption, the result is a valid PE32 .NET assembly loaded directly into memory via [System.Reflection.Assembly]::Load() -- entirely fileless.

Victims saw a convincing fake Google reCAPTCHA overlay complete with an “I’m not a robot” checkbox. Clicking it triggered the ClickFix social engineering panel...

ACRStealer, a C++ infostealer that harvests passwords, credit card numbers, cookies, and cryptocurrency wallet data.

SectopRAT... Browser credential theft -- Chrome, Firefox, Edge profile data, saved passwords, cookies.

Four contracts served distinct roles: Smart Contract A delivered the anti-analysis dispatcher...

Victims on Windows and macOS were routed to separate payloads tailored to their operating system, with routing handled by real-time OS detection in the browser.

SectopRAT... Software inventory -- enumeration of all installed applications.

SectopRAT... System reconnaissance -- language discovery, physical storage enumeration.

Stage 9: Data Theft Browser credential/cookie theft Cryptocurrency wallet theft Application credential harvesting

Victims saw a convincing fake Google reCAPTCHA overlay complete with an “I’m not a robot” checkbox. Clicking it triggered the ClickFix social engineering panel...

SectopRAT... Email client harvesting -- Outlook and Thunderbird data extraction.

Clicking it triggered the ClickFix social engineering panel, which simultaneously injected a malicious command directly into the victim’s clipboard.

SectopRAT, a .NET-based Remote Access Trojan capable of hijacking browser sessions

Threat actors used a technique called EtherHiding to store payload routing instructions inside blockchain smart contracts, bypassing all URL-based blocking methods entirely.

Stage 8: C2 Communication HTTP to 94[.]26[.]106[.]216:9000 /wbinjget -- heartbeat ... /wmglb -- payload/config download

MITRE ATT&CK Mapping... T1090.002 Cloudflare CDN as C2 proxy layer.

When a victim visits a compromised site, injected code quietly queries the blockchain and retrieves the full payload into the browser with no external URL involved.

MITRE ATT&CK Mapping ... Command and Control Non-Standard Port T1571 Port 9000

MITRE ATT&CK Mapping Tactic Technique ID Notes Exfiltration Over C2 Channel T1041 HTTP exfiltration

The Python loader implements a sophisticated AMSI (Antimalware Scan Interface) bypass... Patch "amsi.dll" to "amXi.dll"... AMSI initialization silently fails