SloppyRAT arrives at the end of a multi-stage delivery chain that begins with a ClickFix-style social-engineering lure instructing the victim to run a command that invokes finger.exe against the attacker-controlled server finger.linked4x[.]com over TCP/79. The Finger response is an obfuscated batch script (caret-escaped cmd.exe invocation) that copies Windows' native curl.exe into %AppData% under a numeric filename with a .com extension, then uses it to download IronPython from GitHub. The IronPython interpreter is renamed to masquerade as a PDF and used to execute zlib-compressed, Base64-encoded Python code that retrieves and runs CastleLoader, which in turn deploys CastleRAT before finally dropping SloppyRAT (delivered as a DLL disguised as hostfxr.dll, staged on both an Azure Blob Storage account and an AWS S3 bucket as a fallback host).

Once resident, SloppyRAT implements 47 built-in commands that are native C++ re-implementations of common PowerShell/cmd cmdlets and aliases (not an embedded PowerShell engine) spanning system/user enumeration (whoami, hostname, Get-ComputerInfo, Get-LocalUser, Get-LocalGroupMember), file and directory operations (ls, dir, Get-ChildItem, New-Item, Remove-Item), process and service management (Get-Process, tasklist, Get-Service, Start-Process), networking checks (Test-NetConnection, Resolve-DnsName), and Defender queries/tampering (Get-MpComputerStatus, Set-MpPreference, Add-MpPreference). It also implements a reverse SOCKS proxy: the C2 issues open/close actions with a request_id over a polling /api/poll endpoint, and the implant confirms readiness via /api/proxy/ack, letting the operator pivot through the infected host for internal reconnaissance and lateral movement toward eventual ransomware deployment.

C2 communication is HTTPS with JSON payloads, authenticated via a hardcoded X-API-Key header, with a per-host machine ID derived from an FNV hash of the volume serial number, volume label, filesystem name, and computer name. TLS certificate pinning (hash comparison against an expected SHA256) is used to detect and abort on interception/MITM inspection. As a takedown-resistant fallback, SloppyRAT can retrieve C2 location data from the Polygon blockchain via JSON-RPC (observed smart-contract function selector 0xd6bd8727); Zscaler notes the actual contract address was not recovered from analyzed samples and this EtherHiding capability may still be under active development.

Defense evasion centers on a Hell's Gate-style indirect/direct syscall implementation: SloppyRAT resolves roughly 21 Windows API functions via a DJB2 hash of their names, reads the corresponding NTDLL stub, locates the 0xB8 (mov eax) opcode, extracts the syscall number from the following 4 bytes, and issues the syscall directly — bypassing userland API hooks placed by EDR/AV. Ten of these resolved functions (including NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory, NtCreateFile, and NtOpenProcess) are observed in active use. Additional obfuscation layers include stack-based XOR with unique 4-byte keys, single-byte global XOR, an affine cipher (modulus 127) reserved for the Polygon-resolver strings, 13 functions whose code bodies are decrypted at runtime via a positional XOR formula, and substantial junk-code insertion to frustrate static analysis.

Notably, the malware's two persistence mechanisms both appear to be broken as implemented: a Registry Run Key write under HKCU\Software\Microsoft\Windows\CurrentVersion\Run (name 'rundll32') omits the required DLL path and export, and a COM-hijacking routine builds a new CLSID (via an FNV-1a hash of the computer name) under HKLM\...\CLSID\{clsid}\InprocServer32 rather than hijacking an existing one — defeating the purpose of COM hijacking. Zscaler explicitly characterizes both as incorrectly implemented, which is consistent with the 'sloppy' naming.

Attribution caveat: Zscaler does not name a specific threat actor or group for SloppyRAT, describing it only as likely used by 'a ransomware-related threat actor.' The preceding stages of the delivery chain (CastleLoader, CastleRAT) are well-documented tools developed and operated by the group Recorded Future's Insikt Group tracks as GrayBravo (formerly TAG-150), a malware-as-a-service operator active since at least March 2025 known for rapid development cycles and an expansive multi-tiered infrastructure — but no source reviewed for this research formally attributes SloppyRAT itself to that group, so threat_actor is recorded as Unknown pending further correlation.