Date: 09/25/2026
Severity: High
Summary
Researchers uncovered a SectopRAT (ArechClient2) variant hidden inside a legitimate Italian audio workstation application. Attackers tampered with FrameworkBase.dll to sideload sdkcra.dll, while the encrypted SectopRAT payload was embedded in legitimate-looking database files and launched through a scheduled task. The malware decrypts and executes its payload in memory, enabling remote device control, screen capture, process/file management, and sensitive data collection. Researchers found no evidence that the software vendor distributed the compromised version, indicating the software was modified after distribution.
Indicators of Compromise (IOC) List
Domains/URLs | https://bsc-dataseed1.binance.org/ https://bsc-dataseed2.binance.org/ https://bsc-dataseed3.binance.org/ https://bsc-dataseed4.binance.org/ https://bsc-dataseed1.defibit.io/ https://bsc-dataseed2.defibit.io/ https://bsc-dataseed3.defibit.io/ https://bsc-dataseed4.defibit.io/ https://bsc-dataseed1.ninicoin.io/ https://bsc-dataseed2.ninicoin.io/ https://bsc-dataseed3.ninicoin.io/ https://bsc-dataseed4.ninicoin.io/ http://98.142.252.140:9000/wmglb |
IP Address | 98.142.252.140 |
Hash | 48D3ECBB9E0B6BABE6E53E2082A076BAD07EF61CCD98DCC8B9E4F390B937788B
37FCBCB21D16866784050682C58424C91D3A736F6FD599271FA6E53CF5CA8A92
EFA07701570983909EF923EA79BB032F19FD9DAC0B819FA0E4F6B1161A4CC221
95F6ABD3C43EF4B33CD61D054527233DD2CE705804D44A04BE96CFB73BB52E3A
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "http://98.142.252.140:9000/wmglb" or url like "http://98.142.252.140:9000/wmglb" or siteurl like "http://98.142.252.140:9000/wmglb" or domainname like "https://bsc-dataseed3.ninicoin.io/" or url like "https://bsc-dataseed3.ninicoin.io/" or siteurl like "https://bsc-dataseed3.ninicoin.io/" or domainname like "https://bsc-dataseed4.binance.org/" or url like "https://bsc-dataseed4.binance.org/" or siteurl like "https://bsc-dataseed4.binance.org/" or domainname like "https://bsc-dataseed2.defibit.io/" or url like "https://bsc-dataseed2.defibit.io/" or siteurl like "https://bsc-dataseed2.defibit.io/" or domainname like "https://bsc-dataseed2.ninicoin.io/" or url like "https://bsc-dataseed2.ninicoin.io/" or siteurl like "https://bsc-dataseed2.ninicoin.io/" or domainname like "https://bsc-dataseed3.binance.org/" or url like "https://bsc-dataseed3.binance.org/" or siteurl like "https://bsc-dataseed3.binance.org/" or domainname like "https://bsc-dataseed1.defibit.io/" or url like "https://bsc-dataseed1.defibit.io/" or siteurl like "https://bsc-dataseed1.defibit.io/" or domainname like "https://bsc-dataseed3.defibit.io/" or url like "https://bsc-dataseed3.defibit.io/" or siteurl like "https://bsc-dataseed3.defibit.io/" or domainname like "https://bsc-dataseed1.ninicoin.io/" or url like "https://bsc-dataseed1.ninicoin.io/" or siteurl like "https://bsc-dataseed1.ninicoin.io/" or domainname like "https://bsc-dataseed2.binance.org/" or url like "https://bsc-dataseed2.binance.org/" or siteurl like "https://bsc-dataseed2.binance.org/" or domainname like "https://bsc-dataseed4.ninicoin.io/" or url like "https://bsc-dataseed4.ninicoin.io/" or siteurl like "https://bsc-dataseed4.ninicoin.io/" or domainname like "https://bsc-dataseed4.defibit.io/" or url like "https://bsc-dataseed4.defibit.io/" or siteurl like "https://bsc-dataseed4.defibit.io/" or domainname like "https://bsc-dataseed1.binance.org/" or url like "https://bsc-dataseed1.binance.org/" or siteurl like "https://bsc-dataseed1.binance.org/" |
Detection Query 2 : | dstipaddress IN ("98.142.252.140") or srcipaddress IN ("98.142.252.140") |
Detection Query 3 : | sha256hash IN ("48D3ECBB9E0B6BABE6E53E2082A076BAD07EF61CCD98DCC8B9E4F390B937788B","37FCBCB21D16866784050682C58424C91D3A736F6FD599271FA6E53CF5CA8A92","EFA07701570983909EF923EA79BB032F19FD9DAC0B819FA0E4F6B1161A4CC221","95F6ABD3C43EF4B33CD61D054527233DD2CE705804D44A04BE96CFB73BB52E3A")
|
Reference:
https://www.fortinet.com/blog/threat-research/uncovering-a-sectoprat-variant-embedded-in-legitimate-software