Executive Summary
FortiGuard Labs identified a sophisticated variant of SectopRAT (also known as ArechClient2) concealed within tampered legitimate audio workstation software. The malware utilizes a multi-stage loading process where a tampered DLL (FrameworkBase.dll) initiates the execution of malicious ASM code hidden in database files, eventually launching a heavily obfuscated .NET RAT payload.
The RAT establishes an encrypted AES-based connection to a C2 server, utilizing a backup domain mechanism involving Binance Coin (BNB) related infrastructure if primary connections fail. The payload supports 29 control commands, including remote shell execution, screen capture, and management of a secondary module, WbElevation.dll, specifically designed for browser data extraction.
This threat is high-severity due to its focus on stealing sensitive data, including cryptocurrency wallets, browser credentials, and session cookies from a wide range of applications. The deployment of the malware in C:\ProgramData and its use of scheduled tasks for persistence highlights its evasion capabilities in Windows environments.