A recent investigation by FortiGuard Incident Response has uncovered a sophisticated malware campaign utilizing SectorpRAT, a Windows malware known for its stealthy approach. The threat actors cleverly concealed a variant of SectorpRAT within altered components of legitimate digital audio software, a product made by an Italian company. This layered approach resulted in a multi-stage infection chain, granting attackers remote control over the affected Windows systems.

FortiGuard’s investigation discovered the tampered files under C:\ProgramData, a location routinely used for storing application data, rather than in the software’s usual installation folder. Crucially, there was no evidence suggesting the original software vendor distributed a compromised version. The attackers leveraged Windows Task Scheduler to automatically launch ReportDump.exe, a component that seemingly manages crash reporting, but served as a critical entry point for the malware.

Following the launch of ReportDump.exe, FrameworkBase.dll, a DLL modified through its Import Address Table (IAT), was loaded. This modification introduced sdkcra.dll, acting as the malicious entry point. FrameworkBase.dll then proceeded to load stp_aim_x64_vc15.dll, which abuse the Windows EnumSystemCodePagesW() callback mechanism to execute the decrypted code in memory.

Subsequent stages involved API hashing, obscuring Windows API names behind numeric values, and resolving 187 Windows functions. Data was read from pool.db and decrypted to recover the full SectorpRAT payload. The final RAT, a 64-bit .NET executable, employed techniques such as randomized names, calli instructions, and control-flow flattening to evade detection.

SectorpRAT established a connection to a hardcoded C2 server at 98.142.252.140:15847. In the event the primary server was unavailable, the malware attempted to contact 12 backup domains via HTTP POST requests to recover an alternative C2 address, which appeared linked to Binance Coin (BNB) mining, though the attackers’ potential compromise of these domains couldn’t be confirmed. The C2 traffic utilized AES encryption, facilitating covert communication.

This C2 server facilitated 29 commands, allowing the operator to execute screen capture, manage files and processes, remotely run commands, initiate system restarts, and – most critically – steal data. During activation of the 'DeployBrowserKey' command, SectorpRAT downloaded WbElevation.dll, which collected browser credentials, URLs, autofill data, payment-card details and cookies, while also scanning applications and cryptocurrency wallets like Thunderbird, Steam, Battle.net, GeForce Experience, Atomic Wallet, Exodus, Electrum, Daedalus Mainnet, MetaMask, Chain Browser Wallet, TronLink and Coinbase Wallet.

Furthermore, SectorpRAT incorporated an ‘UnInstall’ command, waiting six seconds before deleting its executable, ensuring adequate process closure. The investigation ultimately highlighted the dangers of attackers modifying legitimate software components and exploiting their normal loading behaviour. Windows users should prioritize obtaining software from official sources, avoiding cracked installers, and scrutinizing scheduled tasks, particularly those launching programs from unusual locations like C:\ProgramData.