SloppyRAT: A New Tool For Ransomware Attacks

This report provides a technical analysis of SloppyRAT, outlining its ClickFix-style lure and downloader chain (finger.exe, renamed curl, IronPython), reflective DLL loading of a SloppyRAT payload, and deployment of CastleLoader/CastleRAT. The analysis details anti-analysis measures (string obfuscation, encrypted code blocks, junk code, Hell's Gate syscalls), certificate-pinned HTTPS C2 with JSON endpoints (including RC4-encrypted, Base64-encoded payloads and reverse SOCKS capability), multiple command execution handlers (built-in cmdlets, PSInline/CLR, PPID-spoofed PowerShell, and WMI), flawed persistence attempts, and several IOCs (download URLs, user-agents, API key/hash values).