FortiGuard Incident Response has detailed an intrusion in which SectopRAT, a .NET Remote Access Trojan (RAT) also known as ArechClient2, was hidden inside a tampered copy of legitimate audio software from an Italian company.
Fortinet’s analysis, published earlier today, said the evidence pointed to local modification rather than a supply-chain compromise.
The folder sat under C:\ProgramData rather than the software’s normal installation directory, and Fortinet found no evidence the vendor distributed a compromised version. Xiaopeng Zhang, a researcher at Fortinet’s FortiGuard Labs and the blog’s author, told Expert Insights there was no clear indication the victim organization had been specifically targeted.
“We believe the attackers used the legitimate application to make the malware look less suspicious,” Zhang said. He added that SectopRAT has previously disguised itself as legitimate software, including the Notion installer and Claude Desktop.
The folder held the program’s own executable, apparently its crash-reporting component, set to run as a scheduled task. When launched, it loaded one of the program’s DLLs, which had been modified to pull in a malicious one.
That DLL decrypted shellcode hidden in one of two database files and ran it through a legitimate Windows API callback. The shellcode resolved 187 Windows APIs at runtime, then decrypted the SectopRAT payload from the second database and ran it in memory without writing it to disk.
What SectopRAT Steals, and How It Stays in Contact
Once running, SectopRAT contacted its Command-and-Control (C2) server over an encrypted channel and supported 29 commands, covering file and process management, screen capture, remote command execution, system reboot, and self-removal.
It targeted saved credentials, autofill data, payment card details, and cookies in about 40 browsers, as well as Thunderbird, gaming applications, and cryptocurrency wallets. It downloaded an extra module from its C2 server to help extract browser data.
If its main server was unreachable, the malware fetched a backup C2 address through one of 12 addresses Fortinet listed. All are public endpoints for the BNB Smart Chain blockchain, which suggests the fallback address is stored on-chain, a technique seen in other recent malware.
“An audio program accessing browser credentials or running unrelated commands should prompt investigation, regardless of its name,” Jason Soroko, senior fellow at Sectigo, told Expert Insights.
Len Noe, solutions architect at BeyondTrust, warned that stolen credentials outlive the infection. “They are keys, and keys keep working after the infected machine has been cleaned and reimaged,” he told Expert Insights, adding that every account that touched a compromised endpoint should be treated as exposed.
