Rewterz Threat Alert – New SectopRAT Uses Second Desktop to Control Browsers

Severity

High

Analysis Summary

This new remote access malware creates a second desktop that is invisible to the system’s user. The threat actor can surf the Internet using the infected machine. SectopRAT is a .NET based remote access malware. The threat actor used ConfuserEx to obfuscate the control flow and add anti-tamper to the .NET assembly. The anti-tamper prevents tools like DnSpy from decompiling the code.
The “Start stream” packet will either stream the current desktop or create another desktop using the hardcoded desktop name “sdfsddfg”. The second desktop is not visible to the person who sits in front of the infected computer. The threat actor however can use “Init browser” to surf the Internet via the second desktop on the infected system. The “Init browser” packet has support for running Chrome, Firefox or Internet Explorer.

It will change browser configuration, use start parameters and modify registry settings to disable security and make the browsers faster. E.g. for Chrome it disables sandboxes, the graphics cache and graphics options like 3d-apis, flash-3d, gpu-rasterization, gpu-vsync. The browser paths are hardcoded and don’t use any environmental variables, which limits compatibility of the RAT. SectopRAT is used in the wild but still looks unfinished and in parts hastily done. Some of the class names and also the name of the second desktop look like they were produced while trying to type arbitrarily on the keyboard because the keys are right next to each other and repeated by finger motion.

Impact

• Unauthorized Remote Access
• Security Bypass

Indicators of Compromise

MD5

• fb4635e8ad7716789e76d759373ab95a
• 9eb50c6cdb59d11b01ca9f069e8ba79d
• 30912073152a47e66b9d9c053cd56077

SHA-256

• 4409d2170aa9989c6a8dd32b617c51a7c3e328b3c86410813c016691b2bd7774
• b1e3b5de12f785c45d5ea3fc64412ce640a42652b4749cf73911029041468e3a
• d5a3d47e1945e9d83a74a96f02a0751abd00078ee62e6d3a546a050e0db10d93

Source IP

45.142.213[.]230

URL

• http[:]//45.142.213[.]230/bssd[.]exe
• http[:]//45.142.213[.]230/blad[.]exe

Remediation

• Block the threat indicators at their respective controls.
• Keep web browsers updated to latest patched versions.
• Closely monitor all network activities.
• From time to time, make sure to check if sandboxes and other security measures are working properly.