SectopRAT: New version adds encrypted communication

New appearances of SectopRAT infection attempts in our telemetry prompted me to investigate the threat that seemed in its infancy at the time of the first article. The malware has been refined and gotten more features since. To sum up the first article: SectopRAT uses a second, hidden desktop to allow remote control. Parts of it seem unfinished.

While the previous article states that SectopRAT was first mentioned in 15. November 2019, I have now discovered that earlier tweets by @nao_sec from March 2019 use a different name for the malware: ArechClient. Other aliases are 1xxbot, ArechSoft and Asatafar. Most names stem from the module name of the RAT or the PDB path. This name has changed in the course of development, likely to evade detection and identification. For the sake of consistency and clarity I will stick with SectopRAT because the use of a second desktop seems to be the most notable core-feature. Many antivirus naming policies also forbid using a name that the malware developer has chosen.

This decompressed file turns out to be another injection library^[3]. At first glance the two libraries^[2][3] look different because they use a different obfuscation. But they are actually the same injection library. This does not make sense from an attacker's perspective as adding more layers of the same provide ample opportunity to detect the code of the packer stub, at least moreso than having just one. If one obfuscation evades the antivirus software, the other might not.

The decompressed library^[3] is the last packed layer and finally performs injection of SectopRAT^[4] into its own child process via classic RunPE.

The CnC communication encryption key is saved in a 32 byte array named rawData. This key changes with different build versions. The CnC communication data is encrypted and decrypted with AES256 using said key and a randomly generated 16 byte intitialization vector (IV). This IV is prepended to the encrypted data before it is sent.

Besides added encryption, the server also supports a number of new commands. These are triggered via a JSON (a data-interchange format) string that contains one of the following command strings.

Most of these command strings are not implemented yet. The ones that are there mainly support the CnC encryption. The non-implemented strings paint a picture of planned updates to SectopRAT which may include screen capturing, controlling the screen resolution and fullscreen support. The purpose of the participant list as well as the ReceiveControlInt command is not clear. ReceiveServerAfkSystem may be a notification that the user is "away-from-keyboard", which means the system is currently not used.

SectopRAT has no code related to persistence anymore. This part was probably outsourced to the loader.

In my last article about SectopRAT I published a Yara rule that contained three method names, an enum, and the module name. All but one of the method and module strings have been renamed in the newest build:

• EnoughSpace -> EnoghtSpace
• RemoteClient -> rsddsrrg
• InitHDesktop -> WaitReq

This might not be a coincidence. We know that malware developers read the news. This is why public Yara rules are often only suitable to collect past samples. I recommend malware hunters after publishing detection rules to have a second set of entirely different private rules for staying up-to-date on current samples.

SectopRAT is actively used to infect systems which is evident by our telemetry as well as researchers like @nao_sec who found the malware being distributed via RIG exploit kit. Stub methods in the code show which functionality is likely planned to be added soon. That may include screen capturing, full screen support and screen resolution settings.

Malware naming is, once again, a difficult topic to navigate. Earlier mentions of the malware were unknown due to the different naming by researchers. It often comes down to having a bit of luck and good contacts to other researchers to see the connection. At the moment there is no other solution to that than documenting aliases in blogs and public resources.

Aliases: 1xxbot, ArechClient, ArechSoft, Arech, AsataFar, AsataFarClient

First known appearance: March 2019 https://twitter.com/nao_sec/status/1103474183676125185

TCP IP and port: 54.194.254.16:15647

Build id: Build 3

Compilation date: 2020-10-19 19:07:33

Compiler: .NET Framework 4

Current server IP saved in: %LOCALAPPDATA%\Microsoft\crds.rtt

AES key for CnC communication: 64 6a 14 63 72 7f d8 7d c5 f5 30 46 8f 7f b0 59 28 85 67 d2 38 64 e 5e 8d 91 d2 4b 45 d1 25 d5