7 minhigh
SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz
SloppyRAT is a new RAT delivered via ClickFix lures, using EtherHiding and blockchain-based C2 to support ransomware operations. SloppyRAT is a Windows RAT delivered through a multi-stage ClickFix chain involving finger.exe, IronPython, and CastleLoader. It features 47 built-in PowerShell-like commands, encrypted code blocks, indirect syscalls, and EtherHiding for resilient C2.
Sens:▲ 24hConf:high
IOCs37
22sha2565domain4url3file path2registry key1ip
Detection / Hunteropenrouter
Immediate Actions
defender takeaway
- Block egress traffic on TCP port 79 to prevent finger.exe C2.
- Block execution of finger.exe on endpoints.
- Block listed C2 domains and IP addresses at network perimeter.
- Hunt for User-Agent strings DLLMemLoader/1.0 and CommandExecutor/1.0.
Key Takeaways
- Delivered via ClickFix lure using finger.exe to fetch batch script from finger.linked4x.com.
- Uses Polygon JSON-RPC for C2 resolution via EtherHiding, though no smart contract address found yet.
- Implements 47 built-in PowerShell-like commands executed via Windows APIs, not PowerShell.
- Persistence is flawed: Run key and COM hijacking attempts fail due to incorrect DLL path and export.
- Uses certificate pinning against full DER-encoded certificate to block TLS MiTM inspection.
Attack Chain
- Initial Access: ClickFix lure uses finger.exe to download batch script from finger.linked4x.com
- Execution: Batch script renames curl.exe, downloads IronPython, executes encoded Python to fetch CastleLoader and CastleRAT
- Persistence: Attempts Run registry key and COM hijacking (both implemented incorrectly)
- C2: SloppyRAT communicates over HTTPS with JSON messages, using certificate pinning and API key auth
- Defense Evasion: Uses encrypted code blocks, junk code, indirect syscalls, and string obfuscation
- Lateral Movement: Reverse SOCKS proxy via /api/poll endpoint for internal network access
Affected Systems
- Windows systems with .NET Framework
- Windows environments using standard PowerShell
- Corporate networks allowing egress on TCP port 79
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Indirect syscalls and PPID spoofing evade some hooks; built-in commands avoid spawning powershell.exe. |
| Network Visibility | Low | Certificate pinning blocks TLS MiTM inspection; C2 uses standard HTTPS with JSON. |
| Detection Difficulty | Hard | Multiple evasion layers: encrypted code, indirect syscalls, PPID spoofing, certificate pinning, and built-in commands. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Detect finger.exe spawning cmd.exe or making external network connections on port 79 (T1059). | Process creation and network connection logs | Initial Access | Low — finger.exe is rarely used |
| Detect renamed curl.exe or IronPython executables downloading from GitHub releases (T1105). | Process creation, file creation, network connection logs | Execution | Medium — legitimate dev tools may use similar patterns |
| Detect processes loading clr.dll or System.Management.Automation.dll without spawning powershell.exe (T1059.001). | Module load events, process creation logs | Execution | Medium — .NET applications load CLR normally |
| Detect powershell.exe spawned with explorer.exe as parent (T1055.012). | Process creation logs with parent-child relationships | Defense Evasion | Low — explorer.exe rarely spawns powershell.exe directly |
Required Log Sources
- Process creation events (Sysmon EID 1)
- Network connections (Sysmon EID 3)
- Registry modifications (Sysmon EID 12, 13)
- DNS queries (Sysmon EID 22)
- File creation events (Sysmon EID 11)
- PowerShell script block logs (EID 4104)
Key Behavioral Indicators
- finger.exe making outbound network connections
- curl.exe renamed with .com extension in AppData
- IronPython executable renamed with numeric filename
- User-Agent string DLLMemLoader/1.0
- User-Agent string CommandExecutor/1.0
- X-API-KEY header containing hardcoded API key
Control Gaps
- TLS inspection bypassed by certificate pinning
- Indirect syscalls bypass userland API hooks
- Built-in commands avoid spawning powershell.exe
- PPID spoofing misleads parent-child process monitoring
- Junk code and string obfuscation evade static signatures
False Positive Assessment
Low — finger.exe external connections, DLLMemLoader User-Agent, and hardcoded API key are highly specific to SloppyRAT activity.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Block finger.linked4x.com, skipraid.com, api.truesmart.org, api.telephoneip.net.
- Block stro7121.blob.core.windows.net and backup-ubt.s3.us-east-1.amazonaws.com hostfxr.dll paths.
- Monitor and block connections to 62.106.66.148 on port 443.
- Deploy network rules for known SloppyRAT C2 HTTP headers.
User Protection
- Enable AMSI for PowerShell to catch PSInline CLR-based execution.
- Monitor for powershell.exe spawned by explorer.exe (PPID spoofing).
- Alert on renamed curl.exe or IronPython in AppData directories.
- Enable Windows Defender tamper protection to block Set-MpPreference attempts.
Security Awareness
- Train users to recognize ClickFix-style fake verification prompts.
- Instruct users not to run commands copied from untrusted web pages.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping43 techniques
Tactic
Execution
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Discovery
T1082System Information DiscoveryT1016System Network Configuration DiscoveryT1087Account DiscoveryT1007System Service DiscoveryT1057Process DiscoveryT1012Query RegistryT1049System Network Connections DiscoveryT1217Browser Information DiscoveryT1518.001Security Software DiscoveryT1046Network Service DiscoveryT1135Network Share DiscoveryT1069.001Local GroupsT1069Permission Groups DiscoveryT1087.001Local Account
Tactic
Command and Control
Plain-Language Summary
A new remote access tool called SloppyRAT is being used to help ransomware attackers break into networks. It tricks users into running it through fake error messages and then downloads additional tools. The software can secretly control infected computers, steal information, and move through networks. Organizations should block the listed malicious domains and IP addresses and watch for unusual use of the finger.exe program.
Additional IOCs
- Domains:
stro7121[.]blob[.]core[.]windows[.]net- Python downloader C2 domain
- Urls:
hxxps://skipraid[.]com/dsVGmQTrzX/default2- CastleLoader download URL
- File Hashes:
8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990(SHA256) - SHA256 of SloppyRAT DLLff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5(SHA256) - SHA256 of SloppyRAT DLL680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21(SHA256) - SHA256 of SloppyRAT DLLbdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd(SHA256) - SHA256 of SloppyRAT DLL607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9(SHA256) - SHA256 of SloppyRAT DLL7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7(SHA256) - SHA256 of SloppyRAT DLL6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013(SHA256) - SHA256 of SloppyRAT DLL00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec(SHA256) - SHA256 of SloppyRAT DLL93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490(SHA256) - SHA256 of SloppyRAT DLL971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d(SHA256) - SHA256 of SloppyRAT DLLa13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316(SHA256) - SHA256 of SloppyRAT DLL518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064(SHA256) - SHA256 of SloppyRAT DLL3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19(SHA256) - SHA256 of SloppyRAT DLL2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2(SHA256) - SHA256 of SloppyRAT DLL1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd(SHA256) - SHA256 of SloppyRAT DLLeaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d(SHA256) - SHA256 of SloppyRAT DLLcb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189(SHA256) - SHA256 of SloppyRAT DLLc0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189(SHA256) - SHA256 of SloppyRAT DLL4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56(SHA256) - SHA256 of SloppyRAT DLL466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8(SHA256) - SHA256 of SloppyRAT DLL
- Registry Keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run- Persistence via rundll32 value (implemented incorrectly)HKLM\Software\Classes\CLSID\{840A68BD-B6FE-450A-A951-42A63B9733D1}\InprocServer32- COM hijacking persistence (implemented incorrectly)
- File Paths:
C:\Users\[redacted]\AppData\Local\9342371634011778.com- Renamed curl.exe used for downloading IronPythonC:\Users\[redacted]\AppData\Local\IronPython.3.4.2.pdf- Renamed IronPython zip fileC:\Users\[redacted]\AppData\Local\IronPython.3.4.2\net462\31706105999761.exe- Renamed IronPython interpreter executing base64 Python
- Command Lines:
- Purpose: Download batch script via finger.exe | Tools:
cmd.exe,finger.exe| Stage: Initial Access - Purpose: Download IronPython using renamed curl | Tools:
curl.exe| Stage: Execution - Purpose: Execute zlib compressed base64-encoded Python code | Tools:
IronPython| Stage: Execution
- Purpose: Download batch script via finger.exe | Tools:
- Other:
af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588- Hardcoded API key in X-API-KEY headerMozilla/5.0 (compatible; DLLMemLoader/1.0)- Python loader User-Agent stringK8VGmQTrzX- User-Agent string for CastleLoader/CastleRAT downloadsCommandExecutor/1.0- SloppyRAT C2 User-Agent string
Showing defanged values
- domainapi[.]telephoneip[.]netSloppyRAT C2 domain
- domainapi[.]truesmart[.]orgSloppyRAT C2 domain
- domainfinger[.]linked4x[.]comClickFix script delivery domain
- domainskipraid[.]comCastleLoader and CastleRAT download domain
- domainstro7121[.]blob[.]core[.]windows[.]netPython downloader C2 domain
- file_pathC:\Users\[redacted]\AppData\Local\9342371634011778.comRenamed curl.exe used for downloading IronPython
- file_pathC:\Users\[redacted]\AppData\Local\IronPython.3.4.2\net462\31706105999761.exeRenamed IronPython interpreter executing base64 Python
- file_pathC:\Users\[redacted]\AppData\Local\IronPython.3.4.2.pdfRenamed IronPython zip file
- ip62[.]106[.]66[.]148SloppyRAT C2 IP on port 443
- registry_keyHKCU\Software\Microsoft\Windows\CurrentVersion\RunPersistence via rundll32 value (implemented incorrectly)
- registry_keyHKLM\Software\Classes\CLSID\{840A68BD-B6FE-450A-A951-42A63B9733D1}\InprocServer32COM hijacking persistence (implemented incorrectly)
- sha25600c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcecSHA256 of SloppyRAT DLL
- sha2561439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffdSHA256 of SloppyRAT DLL
- sha2562f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2SHA256 of SloppyRAT DLL
- sha2563a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19SHA256 of SloppyRAT DLL
- sha256466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8SHA256 of SloppyRAT DLL
- sha2564ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56SHA256 of SloppyRAT DLL
- sha256518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064SHA256 of SloppyRAT DLL
- sha256607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9SHA256 of SloppyRAT DLL
- sha256680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21SHA256 of SloppyRAT DLL
- sha2566d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013SHA256 of SloppyRAT DLL
- sha2567bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7SHA256 of SloppyRAT DLL
- sha2568774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990SHA256 of SloppyRAT DLL
- sha25693273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490SHA256 of SloppyRAT DLL
- sha256971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4dSHA256 of SloppyRAT DLL
- sha2569f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9aSHA256 of SloppyRAT DLL
- sha256a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316SHA256 of SloppyRAT DLL
- sha256bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfdSHA256 of SloppyRAT DLL
- sha256c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189SHA256 of SloppyRAT DLL
- sha256cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189SHA256 of SloppyRAT DLL
- sha256eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341dSHA256 of SloppyRAT DLL
- sha256f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98ebSHA256 of config.py Python script
- sha256ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5SHA256 of SloppyRAT DLL
- urlhxxps://backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com/hostfxr[.]dllBackup SloppyRAT DLL download URL
- urlhxxps://skipraid[.]com/dsVGmQTrzX/default2CastleLoader download URL
- urlhxxps://stro7121[.]blob[.]core[.]windows[.]net/dpp1/config[.]pyPython loader script URL
- urlhxxps://stro7121[.]blob[.]core[.]windows[.]net/dpp1/hostfxr[.]dllSloppyRAT DLL download URL