SectopRAT
Aliases: 1xxbot, ArechClient
- Malware type
- rat, credential-stealer
- Family
- Malware family
- Last IoC activity
- 2026-07-22 03:55:48
- Profile updated
- 2026-07-07 13:12:19
Targeted industries: financial-services technology-and-telecommunications government-and-public-sector
Context
SectopRAT, aka ArechClient2, is a .NET RAT with numerous capabilities including multiple stealth functions. Arechclient2 can profile victim systems, steal information such as browser and crypto-wallet data, and launch a hidden secondary desktop to control browser sessions. Additionally, it has several anti-VM and anti-emulator capabilities.
Detection coverage
- 1 YARA rules
Detection rules
- DITEKSHEN_MALWARE_Win_Sectoprat (yara-rule)
Reports & references
- rewterz.com — Rewterz Threat Alert Widely Abused Msix App Installer Disabled By Microsoft Active Iocs (report)
- medium.com — Hostinghunter Series Chang Way Technologies Co Limited A9Ba4Fce0F65 (report)
- blog.sekoia.io — Exposing Fakebat Loader Distribution Methods And Adversary Infrastructure (report)
- cisecurity.org — Top 10 Malware March 2022 (report)
- rapid7.com — Fake Update Utilizes New Idat Loader To Execute Stealc And Lumma Infostealers (report)
- elastic.co — Ghostpulse Haunts Victims Using Defense Evasion Bag O Tricks (report)
- elastic.co — A Wretch Client (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Sectop Rat (report)
- gdatasoftware.com — 35548 New Sectoprat Remote Access Malware Utilizes Second Desktop To Control Browsers (report)
- cdn-production.blackpointcyber.com — Blackpoint Cyber Ratting Out Arechclient2 Whitepaper (report)
- tampabay.tech — Arechclient2 (report)
- gdatasoftware.com — 36633 New Version Adds Encrypted Communication (report)
- dr4k0nia.github.io — Analysing A Sample Of Arechclient2 (report)
- medium.com — Sectoprat A Dangerous Remote Access Trojan Spreading Through Google Fake Ads 0C43A15C1Cd8 (report)
- medium.com — A Long Way To Sectoprat Eb2F0Aad6Ec8 (report)
- vxhive.blogspot.com — Deep Dive Into Sectoprat (report)
- medium.com — Arechclient Decoding Iocs And Finding The Onboard Browser Extension 477F8796568D (report)
- cyberflorida.org — Arechclient2 (report)