SectopRAT (also known as ArechClient2 and 1xxbot) is a heavily obfuscated .NET remote-access trojan with broad information-stealing capability, first documented by G Data in late 2019 and active since. It combines full remote control of the host with an infostealer that harvests browser credentials, cookies, autofill and saved payment data, email, gaming and cryptocurrency-wallet data, and can capture the screen and hijack a hidden secondary desktop to control browser sessions. The family has a long history of masquerading as legitimate software to reach victims: fake Notion installers, a fake Chrome installer served through Google Ads, and a July 2026 'FakeAgent' campaign in which malicious Bing ads steered victims to a lookalike Claude Desktop downloader that delivered SectopRAT to at least 29 organizations (Huntress).

The variant analyzed by FortiGuard Labs in September 2026 was concealed inside legitimate digital-audio software produced by an Italian company. Rather than compromising the vendor's build or distribution pipeline, the operators tampered with the application after it had already been installed on victim systems: they modified the legitimate FrameworkBase.dll so that it would secretly load the malicious payload. The SectopRAT payload itself was encrypted and embedded inside a database file, and was launched through a legitimate-looking executable and DLL-loading mechanism to appear benign. FortiGuard emphasizes this was local tampering of the installed application, not a supply-chain compromise of the vendor and not an exploitation of a vulnerability in the digital-audio application itself - the trusted software was simply repurposed as camouflage.

The new variant differs from earlier SectopRAT builds in how it encrypts its command-and-control traffic. Previous variants initiated an unencrypted connection and only switched to encryption after a negotiation step; this variant applies AES encryption to its network traffic from the very first byte, reducing the window in which plaintext C2 traffic can be observed. This is consistent with the family's broader evolution, which introduced AES256 C2 encryption in early 2021 and has relied on Pastebin-hosted config retrieval for dynamic C2 resolution. FortiGuard catalogued 29 distinct actions the RAT can execute on an infected host, spanning file and process manipulation, screen viewing, command execution, machine restart, and a self-deletion routine intended to remove traces and hinder incident-response analysis.

Technical analysis of a related ArechClient2 sample (SentinelOne) illustrates the family's two-stage architecture. An AutoIt loader (a compiled a3x script) performed process hollowing into a suspended copy of jsc.exe (Microsoft.NET Framework v4.0.30319), a standard Windows utility, and the deobfuscated loader strings revealed the native API calls (CreateProcessW, NtUnmapViewOfSection, NtResumeThread) consistent with that injection. The second-stage .NET payload is heavily obfuscated - strings are stored encrypted in an embedded resource and XOR-decrypted at runtime using flow-dependent variables, opaque predicates, and global variables that make static deobfuscation impractical. The family employs anti-VM and anti-emulator checks, and this sample carried a date-based guardrail that stopped execution when analysis attempts were detected, presenting a misleading Windows-update error. C2 for that sample used TCP port 15647 (77.73.133.83, with a fallback of 34.107.35.186 and a Pastebin-hosted config URL), matching previously captured ArechClient2 traffic and confirming family identity. Darktrace/Cybersprint additionally documented the family's Pastebin-based config retrieval and exfiltration of stolen data to C2 in JSON form, and catalogued the non-standard C2 ports 15647, 15678, 15649, 228, and 80.

Defenders should treat the presence of SectopRAT on a host as a full post-compromise foothold with both remote-control and credential/theft impact. Detection should focus on behavioral indicators that survive the obfuscation and encryption: anomalous process hollowing into jsc.exe, unexpected DLL side-loading from application directories, non-standard TCP beaconing on port 15647, connections to Pastebin immediately preceding C2 beaconing, and the presence of a second desktop / remote session controlling browser windows. Because the malware deletes itself to hide traces, endpoint telemetry and memory forensics are more reliable than on-disk signatures for detection and response.