SloppyRAT: A New Tool For Ransomware Attacks
Zscaler details SloppyRAT, a new DLL backdoor delivered via ClickFix lures that stages CastleLoader and CastleRAT ahead of ransomware attacks.
Zscaler ThreatLabz analyzed SloppyRAT, a DLL-based backdoor distributed via ClickFix lures that abuses finger.exe over TCP port 79 to download a batch script. The malware copies curl.exe to download IronPython 3.4.2 from GitHub and executes zlib-compressed Base64-encoded Python to deploy CastleLoader and CastleRAT, then reflectively loads SloppyRAT in memory. It hinders analysis using XOR stack-string obfuscation, a modified affine cipher with modulus 127, and 13 runtime-decrypted code blocks, while communicating with C2 over a reverse SOCKS channel.
- Delivered via ClickFix lure abusing finger.exe over TCP port 79 to fetch a batch script
- Downloads IronPython 3.4.2 from GitHub to run zlib-compressed, Base64-encoded Python staging CastleLoader and CastleRAT
- Uses XOR stack strings, an affine cipher with modulus 127, and 13 runtime-decrypted code blocks
- Communicates with C2 via reverse SOCKS; defenders can block port 79 egress and finger.exe
- ATT&CK
- T1105 Ingress Tool TransferT1027 Obfuscated Files or InformationT1140 Deobfuscate/Decode Files or InformationT1572 Protocol TunnelingT1204.002 Malicious File
- Vendors
- Zscaler
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 9342371634011778.com | following command line: "C:\Users\[redacted]\AppData\Local\9342371634011778.com" -s -L --tlsv1.2 --ssl-no-revoke -o "C:\Users\[redacted]\Ap |
| domain | linked4x.com | nger.exe to download and execute a batch script from finger.linked4x[.]com as shown in the command line below: "C:\windows\system32\ |
| domain | skipraid.com | CastleLoader and CastleRAT components were downloaded from skipraid[.]com using the User-Agent string K8VGmQTrzX . Alongside Castle |
| domain | stro7121.blob.core.windows.net | mory. This script downloaded a SloppyRAT DLL from hxxps[://]stro7121[.]blob[.]core[.]windows[.]net/dpp1/hostfxr[.]dll and invoked the DLL export name |
| domain | windows.net | and execute a Python script from hxxps://stro7121.blob.core.windows[.]net/dpp1/config.py . SloppyRAT stager The config.py script’s |
| sha256 | af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588 | application/json User-Agent: CommandExecutor/1.0 X-API-KEY: af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588 Content-Length: 49 Host: api.truesmart.org {"machine_id":"a |
| url | https://stro7121.blob.core.windows.net/dpp1/config.py | xe interpreter to download and execute a Python script from hxxps://stro7121.blob.core.windows[.]net/dpp1/config.py . SloppyRAT stager The config.py script’s purpose is to d |
From the original article
11 min read at zscaler.com
IntroductionIn June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain.
By ThreatLabz (Zscaler) · zscaler.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.