SloppyRAT Propose Change

SloppyRAT is a Windows remote-access implant that masquerades as an unsigned copy of a legitimate Microsoft library and is loaded directly into memory within a trusted signed process by an upstream loader chain. It does not establish persistence itself; that role belongs to the loader stages above it. The implant resolves its API imports dynamically at runtime, hiding its capabilities from static import-table analysis, and employs anti-debug and timing checks to resist dynamic analysis, with some builds adding vectored exception hooks. It executes attacker-supplied PowerShell in-process through an embedded .NET helper, PSComRunner, which uses COM activation to run PowerShell without launching powershell.exe or generating normal script-block telemetry. It communicates over HTTPS using certificate pinning, SaaS-like telemetry paths, and authentication patterns that mimic legitimate web traffic, such as bearer tokens and CSRF tokens, with multiple fallback endpoint formats and protocol generations to resist basic network filtering. Its strings and configuration are protected by an affine cipher, with additional XOR layers in polymorphic builds, though a small number of development and deployed builds carry no cipher at all. Individual variants may support reconnaissance, AV/EDR discovery, file downloads, WMI process creation, Python-interpreter hijacking, PNG steganography, SOCKS proxying, blockchain-based C2 recovery, and process injection via thread-context hijacking and PPID spoofing; however, the vast majority of observed builds share the same .NET helper, encryption scheme, and library-masquerading technique.

References

There is no Yara-Signature yet.