SloppyRAT: A New Tool For Ransomware Attacks

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – The infection relies on a ClickFix-style lure that prompts user interaction to launch the chain (‘press—ENTER’) and trigger execution.
• [T1105 ] Ingress Tool Transfer – SloppyRAT downloads multiple stages and tools from remote locations including GitHub, cloud storage, and attacker-controlled domains (‘download and execute a batch script’, ‘downloaded … IronPython’).
• [T1059.001 ] PowerShell – The malware executes both built-in PowerShell-like commands and PowerShell scripts, including PSInline and command handlers (‘PowerShell.Create().AddScript(cmd).Invoke()’).
• [T1059.003 ] Windows Command Shell – It uses cmd.exe to launch commands and execute the initial chain (‘”C:windowssystem32cmd.exe” /c …’).
• [T1059.007 ] JavaScript – Not mentioned.
• [T1059.004 ] Unix Shell – Not mentioned.
• [T1055.012 ] Process Hollowing – Not mentioned.
• [T1055.013 ] Process Doppelgänging – Not mentioned.
• [T1055.001 ] Dynamic-link Library Injection – SloppyRAT reflectively loads a DLL in memory and invokes an export (‘download a DLL in memory’, ‘invoked the DLL export name’).
• [T1027 ] Obfuscated Files or Information – It hides strings, encrypts code blocks, and uses junk code to hinder analysis (‘string obfuscation’, ‘encrypted code blocks’, ‘junk code’).
• [T1027.015 ] Indicator Removal from Tools – Not mentioned.
• [T1140 ] Deobfuscate/Decode Files or Information – Runtime decryption is used to decode strings and code blocks before execution (‘decrypted and executed at runtime’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – SloppyRAT targets Defender settings through built-in commands such as Get-MpComputerStatus and Set-MpPreference (‘Modifies Microsoft Defender configuration’).
• [T1057 ] Process Discovery – Built-in commands enumerate running processes (‘Enumerates running processes’).
• [T1018 ] Remote System Discovery – Commands retrieve host, domain, user, OS, and system information to support reconnaissance (‘Retrieves system information’).
• [T1082 ] System Information Discovery – The malware gathers OS version, machine name, uptime, CPU count, and related host details (‘Retrieves system information’).
• [T1046 ] Network Service Discovery – Test-NetConnection and Test-Connection provide connectivity checks (‘Performs a TCP connectivity probe’).
• [T1016 ] System Network Configuration Discovery – Not mentioned.
• [T1005 ] Data from Local System – Built-in commands read files, registry values, and local environment data (‘Reads a file’s contents’, ‘Reads a registry key’s values’).
• [T1112 ] Modify Registry – Persistence and COM hijacking attempts use registry keys such as Run and CLSID InprocServer32 (‘Adding an entry under the HKCU…Run registry key’).
• [T1546.015 ] COM Hijacking – A fallback persistence method attempts to abuse CLSID InprocServer32 registry entries (‘perform COM hijacking’).
• [T1547.001 ] Registry Run Keys / Startup Folder – The malware attempts persistence through the HKCU Run key (‘Adding an entry under the HKCU…Run registry key’).
• [T1090.001 ] Internal Proxy – SloppyRAT supports reverse SOCKS so the infected host can proxy access to internal systems (‘use the infected host as a proxy’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – C2 traffic uses HTTPS with JSON-formatted messages (‘communicates over HTTPS with JSON-formatted messages’).
• [T1095 ] Non-Application Layer Protocol – The infection vector and tooling include the Finger protocol over TCP port 79 (‘The finger.exe utility uses the Finger protocol’).
• [T1021.002 ] SMB/Windows Admin Shares – Not mentioned.
• [T1055.001 ] Process Injection – Not mentioned.
• [T1569.002 ] Service Execution – Not mentioned.
• [T1134.004 ] Parent PID Spoofing – PSSpoof launches powershell.exe with explorer.exe as the parent process (‘Parent process ID spoofing’).
• [T1055.003 ] Process Hollowing – Not mentioned.
• [T1106 ] Native API – SloppyRAT resolves NT functions and invokes them through direct syscalls instead of standard APIs (‘direct syscall instead of using the Windows API’).
• [T1021.006 ] Windows Remote Management – Not mentioned.
• [T1218.011 ] Rundll32 – The Run key persistence attempt references rundll32.exe as the launch mechanism (‘the name rundll32’).
• [T1059.001 ] PowerShell – The built-in command set includes PowerShell-style execution paths and aliases (‘ps1’, ‘Invoke-Expression’).