Arechclient2

Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.

MITRE ATT&CK Mapping Tactic Technique ID Notes Resource Development Acquire Infrastructure: Domains T1583.001 casyetnx[.]pw via CNOBIN, hosting via dataforest/VDSINA

Victims are typically lured through malicious advertising or SEO poisoning campaigns, believing they are downloading legitimate software such as Grammarly, Microsoft Teams, Notion, or Zoom.

ClearFake is an activity cluster that uses JavaScript injected into compromised websites to deliver malware via drive-by download techniques

When victims open these MSIX packages, the StartingScriptWrapper.ps1 component launches embedded PowerShell scripts that employ process injection to execute POWERTRASH and Carbanak malware... The third identified threat, the FakeBat cluster, also uses Advanced Installer but executes malicious PowerShell scripts via StartingScriptWrapper.ps1.

Stage 3 -- Legitimate Python Binary : The ZIP extracts to a directory containing FNPLicensingService.exe -- which is actually a renamed, legitimately signed CPython 3.15 pythonw.exe... Stage 4 -- Obfuscated Python Loader : chrome_100_percent.pak ... is an ASCII text file containing obfuscated Python code.

often using fake CAPTCHA lures to trick users into executing code via malicious copy and paste (paste and run, ClickFix, fakeCAPTCHA)

The fake CAPTCHA page carries ClickFix instructions that silently copy a malicious script into the user’s clipboard, prompting the victim to paste and execute it manually through the Windows Run dialog box.

MITRE ATT&CK Mapping Tactic Technique ID Notes Persistence Boot or Logon Autostart T1547 SectopRAT standard persistence

Shown above: Sectop RAT persistent on an infected Windows host.

Rather than the standard CreateThread or NtCreateThreadEx injection techniques... the loader uses Windows Fibers: VirtualAlloc(RWX) ... ConvertThreadToFiber(0) ... CreateFiber(0, addr, 0) ... SwitchToFiber(fiber)

MITRE ATT&CK Mapping Tactic Technique ID Notes Persistence Boot or Logon Autostart T1547 SectopRAT standard persistence

Shown above: Sectop RAT persistent on an infected Windows host.

ClearFake fetches and executes base64 encoded and gzip compressed code... The initial smart contract delivers an obfuscated JavaScript payload... Both SharkStealer and ArechClient2 use AES decryption with a hardcoded key... LoaderOnNet... uses ChaCha20Poly1305 encryption for both data exchange with the C2 server and the data pulled from the smart contract.

MITRE ATT&CK Mapping Tactic Technique ID Notes Defense Evasion Software Packing T1027.002 Reversed Base64 + Zlib compression

MITRE ATT&CK Mapping Tactic Technique ID Notes Defense Evasion Masquerading T1036.005 FNPLicensingService.exe (renamed pythonw.exe)

Rather than the standard CreateThread or NtCreateThreadEx injection techniques... the loader uses Windows Fibers: VirtualAlloc(RWX) ... ConvertThreadToFiber(0) ... CreateFiber(0, addr, 0) ... SwitchToFiber(fiber)

The chrome_100_percent.pak file decodes through three distinct layers... reverse string, base64 decode, zlib decompress ... rolling XOR decrypts embedded SectopRAT PE

One of the more technically notable aspects of this campaign is how it hides harmful code inside packages that also contain legitimate software.

Run method: rundll32 [file path] ,LoadForm

Stage 9: Data Theft Browser credential/cookie theft Cryptocurrency wallet theft Application credential harvesting

The fake CAPTCHA page carries ClickFix instructions that silently copy a malicious script into the user’s clipboard, prompting the victim to paste and execute it manually through the Windows Run dialog box.

Smart contract returns base64 encoded tuple (with “START” and “FINISH” markers) consisting of IV and encrypted C2 IP

Lumma Stealer command and control (C2) domains from Triage sandbox analysis... Example of Sectop RAT C2 traffic from an infected Windows host: hxxp[:]//91.92.241[.]102:9000/wmglb ... tcp[:]//91.92.241[.]102:443/ - encoded or otherwise encrypted traffic (not HTTPS/TLS)

Stage 8: C2 Communication HTTP to 94[.]26[.]106[.]216:9000 /wbinjget -- heartbeat ... /wmglb -- payload/config download

Threat actors store data (for example C2 configuration) or code on a public blockchain... they can access it through a legitimate API endpoint... SharkStealer and ArechClient2... pull their C2 configuration from a smart contract... ZigCryptoStealer... uses smart contracts to receive their C2 configuration.

Follow-up malware... Retrieved from: hxxps[:]//enotsosun[.]pw/NetGui.dll Saved to: C:\Users\ [username] \AppData\Local\Temp\16XBPQ29ZBG94TYNOA.dll

ArechClient2 contains one hardcoded C2, fetches second C2 server from Binance Smart Chain via RPC call (eth_call)

MITRE ATT&CK Mapping ... Command and Control Non-Standard Port T1571 Port 9000

tcp[:]//91.92.241[.]102:443/ - encoded or otherwise encrypted traffic (not HTTPS/TLS)

MITRE ATT&CK Mapping ... Exfiltration Over C2 Channel T1041 HTTP exfiltration

The Python loader implements a sophisticated AMSI (Antimalware Scan Interface) bypass... Patch "amsi.dll" to "amXi.dll"... AMSI initialization silently fails