Press play to start listening
Attackers concealed a SectopRAT variant inside tampered components belonging to legitimate digital audio software, creating a multi-stage infection chain that gave them remote control of a Windows system.
FortiGuard Incident Response found the files while investigating an intrusion and shared its findings with Hackread.com ahead of publication. Researchers did not name the software or its developer, stating only that it was a digital audio workstation made by an Italian company.
SectopRAT Returns
SectopRAT (ArechClient2) is not new to Windows malware campaigns. In April, the SANS Internet Storm Center documented an infection in which Lumma Stealer was followed by SectopRAT after a victim downloaded cracked software, showing another route through which the RAT has reached Windows systems.
FortiGuard’s investigation shows a different approach, with the RAT concealed inside modified components of legitimate audio software rather than delivered as a standalone download. The altered files were found under C:\ProgramData on the victim’s machine, not in the software’s usual installation folder. There was also no evidence that the vendor had distributed a compromised version.
FortiGuard did not determine how the altered software folder reached the victim’s computer. Its investigation therefore documents how SectopRAT was loaded after the files were placed on the system, not the initial infection method.
A Legitimate Program Loads the Malware
The attack relies on Windows Task Scheduler to automatically launch ReportDump.exe, a component whose name suggests it is used for crash reporting. The file loads FrameworkBase.dll, which attackers modified through its Import Address Table (IAT), a list that defines the libraries a program loads.
That modification causes FrameworkBase.dll to load sdkcra.dll, the malicious entry point. The DLL decrypts assembly code stored inside Activation.Desktop.db and passes it to a function in stp_aim_x64_vc15.dll. That function abuses the Windows EnumSystemCodePagesW() callback mechanism to execute the decrypted code in memory.
The next stage uses API hashing (hiding Windows API names behind numeric values) to resolve 187 Windows functions. It then reads encrypted data from pool.db and decrypts it to recover the SectopRAT payload.
This layered approach means the final RAT is not simply sitting in the software folder as an obvious executable. Several components work together to extract and launch it.
SectopRAT Leads to Remote Control
The extracted payload is a 64-bit .NET executable that uses randomized names, calli instructions that invoke functions through memory addresses, and control-flow flattening (rearranging code to make analysis harder). SectopRAT then connects to a hardcoded C2 server at 98.142.252.140:15847.
If unavailable, it contacts 12 backup domains through HTTP POST requests to recover another C2 address. FortiGuard found that the domains appear related to Binance Coin (BNB) mining, although it could not establish whether the attacker had compromised them.
The C2 traffic uses AES encryption. FortiGuard identified 29 commands that give the operator control over functions including screen capture, file and process management, remote command execution, system restarts, and data theft.
When the C2 server sends the DeployBrowserKey command, SectopRAT downloads an additional module called WbElevation.dll. The module collects browser credentials, associated URLs, autofill data, saved payment-card details and cookies. It also searches for data stored by several applications and cryptocurrency wallets, including:
- Email: Thunderbird
- Gaming services: Steam and Battle.net
- NVIDIA software: GeForce Experience
- Desktop wallets: Atomic Wallet, Exodus, Electrum and Daedalus Mainnet
- Browser wallets: MetaMask, Chain Browser Wallet, TronLink and Coinbase Wallet.
SectopRAT also supports an UnInstall command that deletes its executable. The malware waits six seconds before removing the file, giving the running process time to close and release it.
FortiGuard found no evidence that the audio-software vendor distributed the tampered files. However, the investigation shows that attackers can modify legitimate program components and use their normal loading behaviour to execute malware.
Windows users should obtain software from official sources, avoid cracked installers and investigate scheduled tasks that launch programs from unusual locations such as C:\ProgramData.
