SloppyRAT: A New Tool For Ransomware Attacks

    Tuesday, September 15, 2026 In: Threat Research Print

    Date: 09/15/2026

    Severity: High

    Summary

    In June 2026, ThreatLabz identified SloppyRAT, a new malware family likely used in ransomware operations to establish an initial foothold and support lateral movement. The malware uses encrypted code blocks, runtime decryption, junk code, and indirect system calls to complicate analysis and detection. SloppyRAT includes EtherHiding as a backup C2 channel, potentially helping attackers maintain communication if primary infrastructure is disrupted. It also uses certificate pinning to prevent security tools from intercepting and inspecting its TLS communications through MiTM techniques. The malware provides attackers with numerous PowerShell-like commands for remote access, although several software bugs affect some of its capabilities.

    Indicators of Compromise (IOC) List 

    Domain/URLs

    finger.linked4x.com

    skipraid.com

    https://skipraid.com/dsVGmQTrzX/default2

    https://stro7121.blob.core.windows.net/dpp1/config.py

    https://stro7121.blob.core.windows.net/dpp1/hostfxr.dll

    https://backup-ubt.s3.us-east-1.amazonaws.com/hostfxr.dll

    stro7121.blob.core.windows.net

    api.telephoneip.net

    api.truesmart.org

    IP Address

    62.106.66.148

    Hash

    9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a

    8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990

    ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5

    680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21

    bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd

    607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9

    7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7

    6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013

    00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec

    93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490

    971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d

    a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316

    518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064

    3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19

    2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2

    1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd

    eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d

    cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189

    c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189

    4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56

    466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8

    f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb

    User Agent 

    Mozilla/5.0 (compatible; DLLMemLoader/1.0)

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "finger.linked4x.com" or url like "finger.linked4x.com" or siteurl like "finger.linked4x.com" or domainname like "https://backup-ubt.s3.us-east-1.amazonaws.com/hostfxr.dll" or url like "https://backup-ubt.s3.us-east-1.amazonaws.com/hostfxr.dll" or siteurl like "https://backup-ubt.s3.us-east-1.amazonaws.com/hostfxr.dll" or domainname like "stro7121.blob.core.windows.net" or url like "stro7121.blob.core.windows.net" or siteurl like "stro7121.blob.core.windows.net" or domainname like "https://stro7121.blob.core.windows.net/dpp1/hostfxr.dll" or url like "https://stro7121.blob.core.windows.net/dpp1/hostfxr.dll" or siteurl like "https://stro7121.blob.core.windows.net/dpp1/hostfxr.dll" or domainname like "https://skipraid.com/dsVGmQTrzX/default2" or url like "https://skipraid.com/dsVGmQTrzX/default2" or siteurl like "https://skipraid.com/dsVGmQTrzX/default2" or domainname like "api.truesmart.org" or url like "api.truesmart.org" or siteurl like "api.truesmart.org" or domainname like "https://stro7121.blob.core.windows.net/dpp1/config.py" or url like "https://stro7121.blob.core.windows.net/dpp1/config.py" or siteurl like "https://stro7121.blob.core.windows.net/dpp1/config.py" or domainname like "skipraid.com" or url like "skipraid.com" or siteurl like "skipraid.com" or domainname like "api.telephoneip.net" or url like "api.telephoneip.net" or siteurl like "api.telephoneip.net"

    Detection Query 2 :

    dstipaddress IN ("62.106.66.148") or srcipaddress IN ("62.106.66.148")

    Detection Query 3 :

    sha256hash IN ("93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490","cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189","c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189","ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5","518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064","1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd","00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec","680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21","f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb","4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56","eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d","466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8","2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2","8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990","6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013","bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd","3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19","a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316","7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7","9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a","607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9","971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d")

    Reference: 

    https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks      


    Tags

    MalwareRATRansomwareEtherHidingMiTMPowerShell Attack

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.