# SectopRAT (ArechClient2) Variant Hidden Inside Legitimate Italian Digital-Audio Software via FrameworkBase.dll Tampering

> FortiGuard Labs (Xiaopeng Zhang) documented a new variant of the SectopRAT (ArechClient2) .NET remote-access trojan and infostealer hidden inside legitimate digital-audio software from an Italian company. Operators tampered with the installed application's FrameworkBase.dll so it would secretly load an encrypted SectopRAT payload embedded in a database file - local post-install tampering, not a compromise of the vendor. The variant encrypts all network traffic with AES from the start, a change from prior variants that negotiated encryption only after first contact.

- **Published:** 2026-09-25T00:00:00Z
- **Last reviewed:** 2026-09-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2646
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sectoprat-italian-audio-software-tl-2026-2646.webp?v=a9c80c44 (Threadlinqs threat intel: SectopRAT Inside Legitimate Audio App: Detection & IOCs (TL-2026-2646) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2646
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

SectopRAT (also known as ArechClient2 and 1xxbot) is a heavily obfuscated .NET remote-access trojan with broad information-stealing capability, first documented by G Data in late 2019 and active since. It combines full remote control of the host with an infostealer that harvests browser credentials, cookies, autofill and saved payment data, email, gaming and cryptocurrency-wallet data, and can capture the screen and hijack a hidden secondary desktop to control browser sessions. The family has a long history of masquerading as legitimate software to reach victims: fake Notion installers, a fake Chrome installer served through Google Ads, and a July 2026 'FakeAgent' campaign in which malicious Bing ads steered victims to a lookalike Claude Desktop downloader that delivered SectopRAT to at least 29 organizations (Huntress).

The variant analyzed by FortiGuard Labs in September 2026 was concealed inside legitimate digital-audio software produced by an Italian company. Rather than compromising the vendor's build or distribution pipeline, the operators tampered with the application after it had already been installed on victim systems: they modified the legitimate FrameworkBase.dll so that it would secretly load the malicious payload. The SectopRAT payload itself was encrypted and embedded inside a database file, and was launched through a legitimate-looking executable and DLL-loading mechanism to appear benign. FortiGuard emphasizes this was local tampering of the installed application, not a supply-chain compromise of the vendor and not an exploitation of a vulnerability in the digital-audio application itself - the trusted software was simply repurposed as camouflage.

The new variant differs from earlier SectopRAT builds in how it encrypts its command-and-control traffic. Previous variants initiated an unencrypted connection and only switched to encryption after a negotiation step; this variant applies AES encryption to its network traffic from the very first byte, reducing the window in which plaintext C2 traffic can be observed. This is consistent with the family's broader evolution, which introduced AES256 C2 encryption in early 2021 and has relied on Pastebin-hosted config retrieval for dynamic C2 resolution. FortiGuard catalogued 29 distinct actions the RAT can execute on an infected host, spanning file and process manipulation, screen viewing, command execution, machine restart, and a self-deletion routine intended to remove traces and hinder incident-response analysis.

Technical analysis of a related ArechClient2 sample (SentinelOne) illustrates the family's two-stage architecture. An AutoIt loader (a compiled a3x script) performed process hollowing into a suspended copy of jsc.exe (Microsoft.NET Framework v4.0.30319), a standard Windows utility, and the deobfuscated loader strings revealed the native API calls (CreateProcessW, NtUnmapViewOfSection, NtResumeThread) consistent with that injection. The second-stage .NET payload is heavily obfuscated - strings are stored encrypted in an embedded resource and XOR-decrypted at runtime using flow-dependent variables, opaque predicates, and global variables that make static deobfuscation impractical. The family employs anti-VM and anti-emulator checks, and this sample carried a date-based guardrail that stopped execution when analysis attempts were detected, presenting a misleading Windows-update error. C2 for that sample used TCP port 15647 (77.73.133.83, with a fallback of 34.107.35.186 and a Pastebin-hosted config URL), matching previously captured ArechClient2 traffic and confirming family identity. Darktrace/Cybersprint additionally documented the family's Pastebin-based config retrieval and exfiltration of stolen data to C2 in JSON form, and catalogued the non-standard C2 ports 15647, 15678, 15649, 228, and 80.

Defenders should treat the presence of SectopRAT on a host as a full post-compromise foothold with both remote-control and credential/theft impact. Detection should focus on behavioral indicators that survive the obfuscation and encryption: anomalous process hollowing into jsc.exe, unexpected DLL side-loading from application directories, non-standard TCP beaconing on port 15647, connections to Pastebin immediately preceding C2 beaconing, and the presence of a second desktop / remote session controlling browser windows. Because the malware deletes itself to hide traces, endpoint telemetry and memory forensics are more reliable than on-disk signatures for detection and response.

## MITRE ATT&CK

- T1204.002 User Execution: Malicious File
- T1059 Command and Scripting Interpreter
- T1055.012 Process Injection: Process Hollowing
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1070.004 Indicator Removal: File Deletion
- T1082 System Information Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1005 Data from Local System
- T1113 Screen Capture
- T1185 Browser Session Hijacking
- T1571 Non-Standard Port
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1071.001 Application Layer Protocol: Web Protocols
- T1219 Remote Access Tools
- T1537 Transfer Data to Cloud Account

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SectopRAT — Process Hollowing Into jsc.exe (CreateRemoteThread)** (`TL-2026-2646-SPL-002`)

Detects the family's signature post-exploitation injection technique. The AutoIt loader performs process hollowing into a suspended copy of jsc.exe (Microsoft.NET Framework v4.0.30319), using CreateProcessW/NtUnmapViewOfSection/NtResumeThread. A Sysmon EventCode 8 (CreateRemoteThread) targeting jsc.exe, or jsc.exe spawning with an anomalous parent, indicates injection into a trusted Microsoft utility — a defensive-evasion masquerade that on-disk signatures miss.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1055.012, T1036, T1059
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=8 OR (EventCode=1 AND Image="*\\jsc.exe"))
| search TargetImage="*\\jsc.exe" OR (EventCode=1 AND Image="*\\jsc.exe" AND NOT ParentImage="*\\Microsoft.NET\\*")
| stats count by ComputerName, SourceImage, Image, TargetImage, ParentImage, EventCode
| sort - count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "jsc.exe"
| where not (InitiatingProcessFolderPath startswith @"C:\Windows\Microsoft.NET")
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, ProcessCommandLine
| union (DeviceEvents
    | where Timestamp > ago(24h)
    | where ActionType == "CreateRemoteThreadApiCall"
    | where RemoteProcessId != 0 and not (InitiatingProcessFolderPath startswith @"C:\Windows")
    | project Timestamp, DeviceName, ActionType, InitiatingProcessFileName, RemoteProcessFileName)
```

### Sigma

```yaml
title: SectopRAT Process Hollowing Into jsc.exe
id: b8c1d2e3-4f5a-4b6c-9d7e-8f0a1b2c3d4e
status: experimental
description: Detects process injection into jsc.exe, the .NET Framework utility used as the hollowing target by the SectopRAT (ArechClient2) AutoIt loader, via CreateRemoteThread or anomalous jsc.exe execution.
references:
    - https://www.sentinelone.com/blog/reverse-engineering-walkthrough-analyzing-a-sample-of-arechclient2/
author: Threadlinqs Team
date: 2026/09/25
tags:
    - attack.defense_evasion
    - attack.t1055.012
    - attack.t1036
    - attack.execution
    - attack.t1059
    - attack.tool.sectoprat
logsource:
    product: windows
    category: create_remote_thread
    definition: 'Requires Sysmon EventID 8 for the CreateRemoteThread branch'
detection:
    selection_remote_thread:
        EventID: 8
        TargetImage|endswith: '\jsc.exe'
    selection_anomalous_exec:
        EventID: 1
        Image|endswith: '\jsc.exe'
    filter_legit_parent:
        ParentImage|startswith: 'C:\Windows\Microsoft.NET\'
    condition: selection_remote_thread or (selection_anomalous_exec and not filter_legit_parent)
falsepositives:
    - MSBuild or other .NET tooling invoking jsc.exe as part of legitimate compilation
    - Development environments compiling JScript
level: high
```

**Known false positives:**

- MSBuild/.NET compilation invoking jsc.exe legitimately
- Security products or dev tooling that inject threads into .NET utilities

**Tuning notes:** Whitelist msbuild.exe and legitimate IDE parent chains for jsc.exe; treat CreateRemoteThread into jsc.exe from an AutoIt (a3x/45.exe) or unsigned parent as high priority. Escalate on any jsc.exe that subsequently makes outbound network connections.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SectopRAT — Unsigned DLL Loaded From Application Directory (KQL) (locked: unlock with TL Creds)
- SectopRAT — AutoIt Loader Spawning Malicious Child / Scripting Execution (locked: unlock with TL Creds)
- SectopRAT — Pastebin Config Retrieval Preceding C2 Beaconing (locked: unlock with TL Creds)
- SectopRAT — Legitimate App Loading [indicator] (Sigma) (locked: unlock with TL Creds)
- SectopRAT — Suspicious [indicator] Execution (Sigma) (locked: unlock with TL Creds)
- SectopRAT — Non-Standard Port C2 / Remote Access (Sigma) (locked: unlock with TL Creds)
- SectopRAT — [indicator] Side-Loading From Application Install Directory (locked: unlock with TL Creds)
- SectopRAT — C2 Beaconing on Non-Standard Port 15647/15678/15649 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `77.73.133[.]83`
- Domain: `pastebin[.]com`
- File hash: `054742329f83a5d177dd1937992e6755f43c420e`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SectopRAT Returns, Hiding Inside a Legitimate Application](https://www.darkreading.com/cyberattacks-data-breaches/sectoprat-returns-hiding-inside-legitimate-application)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [Reverse Engineering Walkthrough: Analyzing a Sample of ArechClient2](https://www.sentinelone.com/blog/reverse-engineering-walkthrough-analyzing-a-sample-of-arechclient2/)
- [Not Your Average Rodent: Darktrace's Mitigation of the SecTop Remote Access Trojan](https://www.darktrace.com/blog/not-your-average-rodent-darktraces-mitigation-of-the-sectop-remote-access-trojan-rat)
- [SectopRAT (win.sectop_rat) - Malpedia](https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat)
- [Ratting Out ArechClient2 - Blackpoint Cyber](https://blackpointcyber.com/wp-content/uploads/2022/11/Blackpoint-Cyber-Ratting-out-Arechclient2-Whitepaper-1.pdf)
- [Fake Claude app promoted by Bing ads pushes SectopRAT malware](https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2646