SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering

Key facts

Detection coverage

As of 2026-09-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2646 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SectopRAT — Process Hollowing Into jsc.exe (CreateRemoteThread)

Detects the family's signature post-exploitation injection technique. The AutoIt loader performs process hollowing into a suspended copy of jsc.exe (Microsoft.NET Framework v4.0.30319), using CreateProcessW/NtUnmapViewOfSection/NtResumeThread. A Sysmon EventCode 8 (CreateRemoteThread) targeting jsc.exe, or jsc.exe spawning with an anomalous parent, indicates injection into a trusted Microsoft utility — a defensive-evasion masquerade that on-disk signatures miss.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1055.012, T1036, T1059
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=8 OR (EventCode=1 AND Image="*\\jsc.exe"))
| search TargetImage="*\\jsc.exe" OR (EventCode=1 AND Image="*\\jsc.exe" AND NOT ParentImage="*\\Microsoft.NET\\*")
| stats count by ComputerName, SourceImage, Image, TargetImage, ParentImage, EventCode
| sort - count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "jsc.exe"
| where not (InitiatingProcessFolderPath startswith @"C:\Windows\Microsoft.NET")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, ProcessCommandLine
| union (DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "CreateRemoteThreadApiCall"
    | where RemoteProcessId != 0 and not (InitiatingProcessFolderPath startswith @"C:\Windows")
    | project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, RemoteProcessFileName)

Sigma

title: SectopRAT Process Hollowing Into jsc.exe
id: b8c1d2e3-4f5a-4b6c-9d7e-8f0a1b2c3d4e
status: experimental
description: Detects process injection into jsc.exe, the .NET Framework utility used as the hollowing target by the SectopRAT (ArechClient2) AutoIt loader, via CreateRemoteThread or anomalous jsc.exe execution.
references:
    - https://www.sentinelone.com/blog/reverse-engineering-walkthrough-analyzing-a-sample-of-arechclient2/
author: Threadlinqs Team
date: 2026/09/25
tags:
    - attack.defense_evasion
    - attack.t1055.012
    - attack.t1036
    - attack.execution
    - attack.t1059
    - attack.tool.sectoprat
logsource:
    product: windows
    category: create_remote_thread
    definition: 'Requires Sysmon EventID 8 for the CreateRemoteThread branch'
detection:
    selection_remote_thread:
        EventID: 8
        TargetImage|endswith: '\jsc.exe'
    selection_anomalous_exec:
        EventID: 1
        Image|endswith: '\jsc.exe'
    filter_legit_parent:
        ParentImage|startswith: 'C:\Windows\Microsoft.NET\'
    condition: selection_remote_thread or (selection_anomalous_exec and not filter_legit_parent)
falsepositives:
    - MSBuild or other .NET tooling invoking jsc.exe as part of legitimate compilation
    - Development environments compiling JScript
level: high

Known false positives:

• MSBuild/.NET compilation invoking jsc.exe legitimately
• Security products or dev tooling that inject threads into .NET utilities

Tuning notes: Whitelist msbuild.exe and legitimate IDE parent chains for jsc.exe; treat CreateRemoteThread into jsc.exe from an AutoIt (a3x/45.exe) or unsigned parent as high priority. Escalate on any jsc.exe that subsequently makes outbound network connections.

• 🔒 SectopRAT — Unsigned DLL Loaded From Application Directory (KQL) · unlock with TL Creds
• 🔒 SectopRAT — AutoIt Loader Spawning Malicious Child / Scripting Execution · unlock with TL Creds
• 🔒 SectopRAT — Pastebin Config Retrieval Preceding C2 Beaconing · unlock with TL Creds
• 🔒 SectopRAT — Legitimate App Loading [indicator] (Sigma) · unlock with TL Creds
• 🔒 SectopRAT — Suspicious [indicator] Execution (Sigma) · unlock with TL Creds
• 🔒 SectopRAT — Non-Standard Port C2 / Remote Access (Sigma) · unlock with TL Creds
• 🔒 SectopRAT — [indicator] Side-Loading From Application Install Directory · unlock with TL Creds
• 🔒 SectopRAT — C2 Beaconing on Non-Standard Port 15647/15678/15649 · unlock with TL Creds

Indicators of compromise

As of 2026-09-25, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2646.

Sample indicators (3 of 17)

• IP address: 77.73.133[.]83
• Domain: pastebin[.]com
• File hash: 054742329f83a5d177dd1937992e6755f43c420e

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

Technical analysis

The variant encrypts all network traffic with AES from the start, a change from prior variants that negotiated encryption only after first contact.

SectopRAT (also known as ArechClient2 and 1xxbot) is a heavily obfuscated .NET remote-access trojan with broad information-stealing capability, first documented by G Data in late 2019 and active since. It combines full remote control of the host with an infostealer that harvests browser credentials, cookies, autofill and saved payment data, email, gaming and cryptocurrency-wallet data, and can capture the screen and hijack a hidden secondary desktop to control browser sessions. The family has a long history of masquerading as legitimate software to reach victims: fake Notion installers, a fake Chrome installer served through Google Ads, and a July 2026 'FakeAgent' campaign in which malicious Bing ads steered victims to a lookalike Claude Desktop downloader that delivered SectopRAT to at least 29 organizations (Huntress).

The variant analyzed by FortiGuard Labs in September 2026 was concealed inside legitimate digital-audio software produced by an Italian company. Rather than compromising the vendor's build or distribution pipeline, the operators tampered with the application after it had already been installed on victim systems: they modified the legitimate FrameworkBase.dll so that it would secretly load the malicious payload. The SectopRAT payload itself was encrypted and embedded inside a database file, and was launched through a legitimate-looking executable and DLL-loading mechanism to appear benign. FortiGuard emphasizes this was local tampering of the installed application, not a supply-chain compromise of the vendor and not an exploitation of a vulnerability in the digital-audio application itself - the trusted software was simply repurposed as camouflage.

The new variant differs from earlier SectopRAT builds in how it encrypts its command-and-control traffic. Previous variants initiated an unencrypted connection and only switched to encryption after a negotiation step; this variant applies AES encryption to its network traffic from the very first byte, reducing the window in which plaintext C2 traffic can be observed. This is consistent with the family's broader evolution, which introduced AES256 C2 encryption in early 2021 and has relied on Pastebin-hosted config retrieval for dynamic C2 resolution. FortiGuard catalogued 29 distinct actions the RAT can execute on an infected host, spanning file and process manipulation, screen viewing, command execution, machine restart, and a self-deletion routine intended to remove traces and hinder incident-response analysis.

Technical analysis of a related ArechClient2 sample (SentinelOne) illustrates the family's two-stage architecture. An AutoIt loader (a compiled a3x script) performed process hollowing into a suspended copy of jsc.exe (Microsoft.NET Framework v4.0.30319), a standard Windows utility, and the deobfuscated loader strings revealed the native API calls (CreateProcessW, NtUnmapViewOfSection, NtResumeThread) consistent with that injection. The second-stage .NET payload is heavily obfuscated - strings are stored encrypted in an embedded resource and XOR-decrypted at runtime using flow-dependent variables, opaque predicates, and global variables that make static deobfuscation impractical. The family employs anti-VM and anti-emulator checks, and this sample carried a date-based guardrail that stopped execution when analysis attempts were detected, presenting a misleading Windows-update error. C2 for that sample used TCP port 15647 (77.73.133.83, with a fallback of 34.107.35.186 and a Pastebin-hosted config URL), matching previously captured ArechClient2 traffic and confirming family identity. Darktrace/Cybersprint additionally documented the family's Pastebin-based config retrieval and exfiltration of stolen data to C2 in JSON form, and catalogued the non-standard C2 ports 15647, 15678, 15649, 228, and 80.

Defenders should treat the presence of SectopRAT on a host as a full post-compromise foothold with both remote-control and credential/theft impact. Detection should focus on behavioral indicators that survive the obfuscation and encryption: anomalous process hollowing into jsc.exe, unexpected DLL side-loading from application directories, non-standard TCP beaconing on port 15647, connections to Pastebin immediately preceding C2 beaconing, and the presence of a second desktop / remote session controlling browser windows. Because the malware deletes itself to hide traces, endpoint telemetry and memory forensics are more reliable than on-disk signatures for detection and response.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1185 Browser Session Hijacking

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1055.012 Process Injection: Process Hollowing; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL

Execution

T1059 Command and Scripting Interpreter; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1219 Remote Access Tools; T1571 Non-Standard Port; T1573.001 Encrypted Channel: Symmetric Cryptography

Discovery

T1082 System Information Discovery

Exfiltration

T1537 Transfer Data to Cloud Account

Credential Access

T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Remediation

Patches

• No vendor CVE applies - the delivery abused a legitimate application's install directory via local tampering, not a product vulnerability; keep all software and EDR definitions current regardless

Immediate actions

• Hunt for and isolate hosts beaconing to SectopRAT C2 on non-standard ports (15647, 15678, 15649) or reaching pastebin.com immediately before failed C2 connections
• Collect memory and endpoint telemetry (process hollowing into jsc.exe, DLL side-loading) before on-disk artifacts are deleted by the RAT's self-deletion routine
• Revoke and rotate credentials, cookies and session tokens found in compromised browser and mail profiles

Workarounds

• Restrict write access to application installation directories to reduce tampering opportunities for DLL side-loading
• Block outbound traffic to Pastebin and known Pastebin-based config retrieval unless business-justified

Longer-term hardening

• Deploy behavioral EDR detections that flag process hollowing, anomalous DLL side-loading, and hidden-desktop session control rather than relying on on-disk malware signatures
• Add the family's C2 IPs and Pastebin config URLs to network perimeter and DNS blocking
• Maintain visibility into scheduled tasks and services that could reinfect hosts after the RAT self-deletes

Timeline

• 2019-11-21 SectopRAT (ArechClient2) first documented by G Data as a .NET RAT that launches a hidden secondary desktop to control victim browser sessions.
• 2021-02-17 G Data reports a new SectopRAT variant adding encrypted (AES256) command-and-control communication and additional commands.
• 2023-01-25 Darktrace observes SectopRAT retrieving config from Pastebin (104.20.67.143) followed by failed C2 beaconing to locked-ioc-11:15647.
• 2023-04-20 Darktrace records 9 connections to locked-ioc-13 (85 KB downloaded) and 1,021 failed connections to locked-ioc-14:15647, indicative of beaconing.
• 2026-02-18 Recorded Future reports GrayCharlie actor distributing SectopRAT alongside other RATs in a suspected supply-chain compromise of law-firm websites.
• 2026-07-22 Huntress documents the 'FakeAgent' campaign: malicious Bing ads on a search for Claude Desktop led to a lookalike downloader that delivered SectopRAT to at least 29 organizations via DLL side-loading.
• 2026-09-24 FortiGuard Labs (Xiaopeng Zhang) publishes analysis of a new SectopRAT variant hidden in legitimate Italian digital-audio software via locked-ioc-5 tampering, with AES-encrypted traffic from the start.

Sources cited

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT Huntress · Research · 2026-07-22
• Reverse Engineering Walkthrough: Analyzing a Sample of ArechClient2 SentinelOne · Research · 2021-01-01
• Not Your Average Rodent: Darktrace's Mitigation of the SecTop Remote Access Trojan darktrace.com · Research · 2023-04-20
• SectopRAT (win.sectop_rat) - Malpedia malpedia.caad.fkie.fraunhofer.de · Research · 2026-09-01
• Ratting Out ArechClient2 - Blackpoint Cyber blackpointcyber.com · Research · 2022-11-01
• SectopRAT Returns, Hiding Inside a Legitimate Application Dark Reading · News · 2026-09-24
• Fake Claude app promoted by Bing ads pushes SectopRAT malware BleepingComputer · News · 2026-07-23

More in malware

• PureRAT and PureLogs Campaign Targeting Japanese Organizations (Phishing, Donut Loader, BYOVD via Lenovo-signed BootRepair.sys)
• SnakeKeylogger infostealer delivered via quote-request phishing emails (JavaScript/PowerShell chain, process hollowing into aspnet_compiler.exe)
• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Threat actors weaponizing GSocket (gs-netcat) for stealthy C2 and persistence on compromised Linux web servers (CVE-2026-43284 LPE attempts)
• eBPF Rootkits Gaining Traction on Underground Forums (Flare research; BPFDoor, Symbiote, LinkPro, CVE-2017-16995 reposts)

Previous and next in malware

• Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access Brokers Previous report
• Phishing campaign targeting Japanese/Korean orgs delivering PureRAT / PureLogs RATs via ZIP archives and diverse loaders (DLL side-loading, Donut, Python, process hollowing, BYOVD) Next report