SloppyRAT Malware Combines Advanced Evasion Techniques With Ransomware Capabilities
Key Takeaways
- •Zscaler ThreatLabz discovered SloppyRAT in June 2026 during an investigation of a multistage campaign that used ClickFix-style social engineering to trick victims into executing malicious commands on Windows systems.
- •The infection chain abuses legitimate Windows tools such as finger.exe and renamed curl.exe, then stages IronPython, CastleLoader, CastleRAT, and finally loads SloppyRAT reflectively into memory to minimize forensic artifacts.
- •SloppyRAT employs layered evasion techniques, including XOR-encrypted strings, runtime decryption of 13 functions, junk code, Hell's Gate-style indirect system calls, and certificate pinning against a hardcoded SHA-256 hash to block TLS interception.
- •The malware communicates with its command-and-control server over HTTPS using JSON messages, encrypting most collected data with RC4 and Base64, and uses a blockchain-based backup mechanism to locate its C2 infrastructure.
- •Despite coding flaws suggesting the malware is still being refined, its capabilities in reconnaissance, remote execution, proxying, and lateral movement make it a potentially valuable component in ransomware operations.
Security researchers have identified a new remote access trojan (RAT) called SloppyRAT that combines multiple stealth techniques with capabilities that could enable attackers to establish an initial foothold, gather intelligence, and move through corporate networks before deploying ransomware.
Zscaler ThreatLabz identified the malware in June 2026 while investigating a multistage infection campaign that used a ClickFix-style technique to persuade victims to execute malicious commands. Researchers found several programming errors indicating that SloppyRAT remains under development, but its current capabilities already include reconnaissance, remote command execution, network proxying, and lateral movement.
SloppyRAT combines encrypted code, indirect Windows system calls, certificate pinning, and a blockchain-based backup mechanism for locating its command-and-control infrastructure. These features give attackers multiple layers of protection against detection and disruption.
ClickFix Campaign Builds the Infection Chain
The attack begins with a social-engineering lure intended to convince victims to run a command on their Windows systems. That command abuses the legitimate Windows finger.exe utility to retrieve a batch script from an attacker-controlled domain.
The Finger protocol normally operates over TCP port 79. Because it has limited legitimate use in most enterprise environments, security teams can reduce exposure by blocking outbound traffic over port 79 and restricting unnecessary access to finger.exe.
The downloaded script copies the legitimate Windows curl.exe utility into the user’s AppData directory and renames it with a numeric filename ending in .com. It then downloads an IronPython package hosted on GitHub while disguising the archive as a PDF file.
IronPython executes a compressed and Base64-encoded Python stage, which downloads CastleLoader and CastleRAT from another attacker-controlled domain. The attackers then deploy an additional Python interpreter and execute a script called config.py hosted through Azure Blob Storage.
That script downloads the SloppyRAT DLL and hostfxr.dll before reflectively loading the malware directly into memory. By reducing the need to write the primary payload to disk, this method can limit forensic artifacts and make traditional file-based investigations more difficult. Researchers observed that the loader used a User-Agent string identifying itself as DLLMemLoader/1.0.
The infection chain gives defenders several points for detection before SloppyRAT establishes its full capabilities. Unusual use of finger.exe, outbound connections to TCP port 79, renamed copies of curl.exe in AppData, unexpected downloads from GitHub or Azure Blob Storage, and the DLLMemLoader/1.0 User-Agent can be investigated together as related signals rather than as isolated events.
Malware Uses Multiple Evasion Techniques
SloppyRAT includes several mechanisms designed to complicate analysis and security monitoring. It conceals strings using XOR encryption and employs runtime code decryption to protect 13 important functions.
The malware also inserts junk code and uses a Hell’s Gate-style approach to invoke Windows system calls directly. These techniques can help malware evade security products that rely heavily on monitoring or hooking commonly used Windows application programming interfaces.
SloppyRAT communicates with its command-and-control server over HTTPS using JSON messages. It also implements certificate pinning by comparing the server certificate with a hardcoded SHA-256 hash. If the certificate does not match the expected value, SloppyRAT terminates the connection.
This behavior can interfere with security tools that attempt to inspect encrypted network traffic through a TLS man-in-the-middle configuration.
SloppyRAT Collects Host Intelligence
The malware uses a hardcoded API key to authenticate with its command-and-control infrastructure. After connecting, it can transmit information about the infected computer, installed security products, command results, and operational errors.
According to Zscaler, much of the collected information is encrypted with RC4 before being encoded using Base64. This combination allows attackers to maintain communications while adding another layer of obfuscation to data exchanged with compromised systems.
Researchers also identified coding flaws in SloppyRAT, suggesting that its developers are still refining the malware. However, those weaknesses have not prevented the current version from providing capabilities that could support a broader intrusion.
The combination of initial access, reconnaissance, remote execution, and lateral movement makes SloppyRAT a potentially useful component in ransomware operations. Its continued development could increase the threat as attackers refine its evasion and network-control capabilities.
Source: CoinTrust
