--- title: Uncovering a SectopRAT Variant Embedded in Legitimate... description: Fortinet's incident response team dissects a SectopRAT (ArechClient2) variant found hidden inside a tampered installation of a legitimate Italian digital audio... canonical: https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Uncovering a SectopRAT Variant Embedded in Legitimate Software | daily.dev og:description: Fortinet's incident response team dissects a SectopRAT (ArechClient2) variant found hidden inside a tampered installation of a legitimate Italian digital audio... og:url: https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik og:image: https://api.daily.dev/og/posts/MPcOv6RiK.png og:image:alt: Uncovering a SectopRAT Variant Embedded in Legitimate Software og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Uncovering a SectopRAT Variant Embedded in Legitimate Software **[FortiGuard Threat Research](https://daily.dev/sources/fortiguard-threat-research)** · 12 min read · 0 upvotes · 0 comments ## Summary Fortinet's incident response team dissects a SectopRAT (ArechClient2) variant found hidden inside a tampered installation of a legitimate Italian digital audio workstation. The malware uses a multi-stage loader chain — a scheduled task, a tampered DLL with a modified Import Address Table, encrypted ASM code executed via an EnumSystemCodePagesW() API abuse trick, and API hash resolution — to decrypt and load a heavily obfuscated .NET RAT payload entirely in memory. Once running, SectopRAT connects to a hardcoded C2 server (with 12 Binance-related backup domains for failover) and supports 29 control commands enabling remote system control, screen capture, file/process management, remote shell, and theft of browser credentials, cookies, autofill data, cryptocurrency wallets, and gaming/email credentials. Fortinet states this appears to be tampering of a legitimate install rather than a supply chain compromise, and provides IOCs, MITRE ATT&CK mappings, and detection signatures. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is SectopRAT and what can it do once it infects a Windows machine? SectopRAT, also known as ArechClient2, is a .NET-based remote access trojan that gives attackers full remote control of a compromised Windows device. One analyzed variant supports 29 control commands enabling remote system administration, screen capture, browser credential and cookie theft, data exfiltration, process/file management, remote shell execution, system reboot, and bot management. _daily.dev surfaces threat research like this for engineers tracking RAT capabilities and defense priorities._ ### How did attackers hide the SectopRAT payload inside legitimate software without a supply chain attack? Attackers tampered with a locally installed copy of a legitimate Italian digital audio workstation rather than compromising the vendor's distribution. They modified FrameworkBase.dll to add a malicious sdkcra.dll to its Import Address Table, placed the tampered files in C:\ProgramData instead of the normal install directory, and set the program's ReportDump.exe as a scheduled task to auto-launch the malicious loader chain. _security teams comparing tampered-binary versus supply-chain risks can follow this kind of analysis on daily.dev._ ### What decryption key and offset does this SectopRAT variant use to recover its payload from pool.db? The decrypted ASM code locates offset 0x1DC18 within the data read from pool.db, then applies a custom decryption routine with a single-byte XOR-style key of 0xBC over a data size of 0xE5A00 bytes to recover the SectopRAT payload, which is identified as a 64-bit .NET executable loaded directly into memory. _reverse engineers tracking malware unpacking techniques like this can follow research feeds on daily.dev._ ## Similar posts on daily.dev - [Threat Actors Weaponize AI Hype to Deliver AsyncRAT](https://daily.dev/posts/threat-actors-weaponize-ai-hype-to-deliver-asyncrat-mwevh7dcd) · FortiGuard Threat Research · 0 upvotes · 0 comments - [SilverFox Hackers Use Go RAT, AV Killer, and Kernel Rootkit in ValleyRAT Campaign](https://daily.dev/posts/silverfox-hackers-use-go-rat-av-killer-and-kernel-rootkit-in-valleyrat-campaign-8mnjmf0s7) · Security Boulevard · 0 upvotes · 0 comments - [Tracking Iranian APT Screening Serpens’ 2026 Espionage Campaigns](https://daily.dev/posts/tracking-iranian-apt-screening-serpens-2026-espionage-campaigns-g1lvjgxxj) · Unit 42 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Uncovering a SectopRAT Variant Embedded in Legitimate Software","url":"https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik"},"datePublished":"2026-09-24T13:11:47.873Z","dateModified":"2026-09-24T13:12:15.121Z","description":"Fortinet's incident response team dissects a SectopRAT (ArechClient2) variant found hidden inside a tampered installation of a legitimate Italian digital audio...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/76c831a5f9130411e57857ea29d08dac?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/76c831a5f9130411e57857ea29d08dac?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"FortiGuard Threat Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"FortiGuard Threat Research","logo":"https://media.daily.dev/image/upload/s--g8QQFZ6i--/f_auto,q_auto/v1780213347/logos/fortiguard-threat-research?_a=BAMAMiWQ0","url":"https://daily.dev/sources/fortiguard-threat-research"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,reverse-engineering","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"FortiGuard Threat Research","item":"https://daily.dev/sources/fortiguard-threat-research"},{"@type":"ListItem","position":3,"name":"Uncovering a SectopRAT Variant Embedded in Legitimate Software"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/uncovering-a-sectoprat-variant-embedded-in-legitimate-software-mpcov6rik#faq","mainEntity":[{"@type":"Question","name":"What is SectopRAT and what can it do once it infects a Windows machine?","acceptedAnswer":{"@type":"Answer","text":"SectopRAT, also known as ArechClient2, is a .NET-based remote access trojan that gives attackers full remote control of a compromised Windows device. One analyzed variant supports 29 control commands enabling remote system administration, screen capture, browser credential and cookie theft, data exfiltration, process/file management, remote shell execution, system reboot, and bot management. daily.dev surfaces threat research like this for engineers tracking RAT capabilities and defense priorities."}},{"@type":"Question","name":"How did attackers hide the SectopRAT payload inside legitimate software without a supply chain attack?","acceptedAnswer":{"@type":"Answer","text":"Attackers tampered with a locally installed copy of a legitimate Italian digital audio workstation rather than compromising the vendor's distribution. They modified FrameworkBase.dll to add a malicious sdkcra.dll to its Import Address Table, placed the tampered files in C:\\ProgramData instead of the normal install directory, and set the program's ReportDump.exe as a scheduled task to auto-launch the malicious loader chain. security teams comparing tampered-binary versus supply-chain risks can follow this kind of analysis on daily.dev."}},{"@type":"Question","name":"What decryption key and offset does this SectopRAT variant use to recover its payload from pool.db?","acceptedAnswer":{"@type":"Answer","text":"The decrypted ASM code locates offset 0x1DC18 within the data read from pool.db, then applies a custom decryption routine with a single-byte XOR-style key of 0xBC over a data size of 0xE5A00 bytes to recover the SectopRAT payload, which is identified as a 64-bit .NET executable loaded directly into memory. reverse engineers tracking malware unpacking techniques like this can follow research feeds on daily.dev."}}]} ```