Malware Hidden in Legitimate Software Can Steal Passwords, Cards and Crypto Wallets
ID: dd17dbef-b5e0-57c5-bb01-7a3f3e4d54b7
STIX ID: report--dd17dbef-b5e0-57c5-bb01-7a3f3e4d54b7
Feed Name: Cyber Press
Threat Score
FortiGuard IR investigated an intrusion in which attackers tampered with a legitimate application's installation folder to hide SectopRAT (ArechClient2), using modified DLL import tables and encrypted payloads to execute a .NET RAT in memory that provides remote control and steals passwords, browser data, saved payment cards, and cryptocurrency wallet data; active IOCs include C2 98.142.252.140:15847 and a module download URL.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.