This new remote access malware creates a second desktop that is invisible to the system’s user. The threat actor can surf the Internet using the infected machine. SectopRAT is a .NET based remote access malware. The threat actor used ConfuserEx to obfuscate the control flow and add anti-tamper to the .NET assembly. The anti-tamper prevents tools like DnSpy from decompiling the code.
The “Start stream” packet will either stream the current desktop or create another desktop using the hardcoded desktop name “sdfsddfg”. The second desktop is not visible to the person who sits in front of the infected computer. The threat actor however can use “Init browser” to surf the Internet via the second desktop on the infected system. The “Init browser” packet has support for running Chrome, Firefox or Internet Explorer.
It will change browser configuration, use start parameters and modify registry settings to disable security and make the browsers faster. E.g. for Chrome it disables sandboxes, the graphics cache and graphics options like 3d-apis, flash-3d, gpu-rasterization, gpu-vsync. The browser paths are hardcoded and don’t use any environmental variables, which limits compatibility of the RAT. SectopRAT is used in the wild but still looks unfinished and in parts hastily done. Some of the class names and also the name of the second desktop look like they were produced while trying to type arbitrarily on the keyboard because the keys are right next to each other and repeated by finger motion.