CTI · corroborated · 2026-09-11

SloppyRAT Malware Uses ClickFix and Blockchain C2 to Help Ransomware Hackers

Full story & timeline

MITRE ATT&CK

• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1021 Remote Services Lateral Movement
• T1071 Application Layer Protocol Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SloppyRAT ClickFix Delivery via finger.exe and Blockchain C2 Resolution
id: c3d5e7f9-a1b2-4c4d-8e6f-0a1b2c3d4e5f
status: experimental
description: Detects SloppyRAT infection chain using Windows finger.exe to fetch payloads from finger.linked4x.com, followed by curl.exe abuse and blockchain-based C2 resolution
references:
  - https://cyberpress.org/
  - https://gbhackers.com/
author: Tia N. List
date: 2026-09-11
tags:
  - attack.execution
  - attack.t1204
  - attack.execution
  - attack.t1059
  - attack.lateral-movement
  - attack.t1021
  - attack.command-and-control
  - attack.t1071
logsource:
  product: windows
  category: process_creation
detection:
  selection_finger_abuse:
    Image|endswith:
      - '\finger.exe'
    CommandLine|contains:
      - 'linked4x'
      - 'port 79'
  selection_curl_staging:
    Image|endswith:
      - '\curl.exe'
    CommandLine|contains:
      - 'AppData'
      - 'http'
      - 'https'
    ParentImage|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  selection_batch_rename:
    Image|endswith:
      - '\cmd.exe'
    CommandLine|contains:
      - 'copy'
      - 'rename'
      - 'curl.exe'
  selection_blockchain_dns:
    Image|endswith:
      - '\node.exe'
      - '\npm.exe'
    CommandLine|contains:
      - 'ethereum'
      - 'blockchain'
      - 'contract'
  condition: selection_finger_abuse or selection_curl_staging or selection_batch_rename or selection_blockchain_dns
falsepositives:
  - Legitimate use of finger protocol in enterprise environments (rare)
level: high

References

• https://cyberpress.org/
• https://gbhackers.com/