CTI · reviewed · 2026-09-30

SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets

Full story & timeline

MITRE ATT&CK

• T1053 Scheduled Task/Job Execution
• T1106 Native API Execution
• T1574 Hijack Execution Flow Stealth
• T1036 Masquerading Stealth
• T1503 Credentials from Web Browsers Credential Access

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SectopRAT Loader - ReportDump.exe Executing From ProgramData
id: 3f0c75b9-2b4f-4508-8350-f75323a03267
status: experimental
description: 'Detects execution of ReportDump.exe from a C:\ProgramData location, the loader chain SectopRAT (ArechClient2) uses after endpoint software tampering: a legitimate executable placed with a digital audio workstation folder under ProgramData loads the IAT-modified FrameworkBase.dll, sdkcra.dll and the encrypted Activation.Desktop.db payload.'
references:
  - https://gbhackers.com/sectoprat-malware/
  - https://cyberpress.org/trusted-software-hides-infostealer/
author: Tia N. List
date: 2026-09-30
tags:
  - attack.execution
  - attack.persistence
  - attack.stealth
  - attack.credential-access
  - attack.t1053
  - attack.t1106
  - attack.t1574
  - attack.t1036
  - attack.t1503
logsource:
  category: process_creation
  product: windows
detection:
  selection_reportdump_in_programdata:
    Image|contains: '\ProgramData\'
    Image|endswith: '\ReportDump.exe'
  condition: selection_reportdump_in_programdata
falsepositives:
  - Software that legitimately ships ReportDump.exe inside the ProgramData tree (rare outside tampered installs)
level: high

References

• https://gbhackers.com/sectoprat-malware/
• https://cyberpress.org/trusted-software-hides-infostealer/