SloppyRAT

ClickFix → finger.exe → CastleLoader/CastleRAT → reflectively-loaded backdoor for ransomware recon and lateral movement

Threat

SloppyRAT

Type

Windows RAT / backdoor (final-stage payload)

Severity

High

Version

v0.1 Draft · 2026-09-12

Author

HuntPack

Confidence

High core-IOC confidence (multi-source corroborated); tenant unverified

STATIC REVIEW PASSED

Executive Summary

What it is: SloppyRAT is a Windows RAT/backdoor first documented by Zscaler ThreatLabz on 2026-09-10 (samples first observed by ThreatLabz in June 2026) and assessed as likely leveraged by a ransomware-related threat actor for host reconnaissance, credential/config harvesting, Defender tampering, and lateral movement. It arrives as the final stage of a longer chain — ClickFix lure → finger.exe retrieval → batch script → renamed curl.exe → IronPython → CastleLoader → CastleRAT → a second Python interpreter → config.py → SloppyRAT DLL reflectively loaded in memory. The CastleLoader/CastleRAT delivery mechanics are already covered by the library's CastleRAT Multi-Stage RAT pack; this pack is scoped to SloppyRAT's own distinct C2 infrastructure, protocol, and on-host behaviors.

Why it's notable: SloppyRAT ships 47 built-in commands that mimic PowerShell cmdlets but are implemented natively in C++ against Win32 APIs (no PowerShell process required), three command-execution handlers of increasing noisiness (native built-ins → in-process PowerShell via CLR/COM → PPID-spoofed powershell.exe), certificate pinning against a hardcoded SHA256, RC4-encrypted request/response bodies, a reverse-SOCKS proxy for internal pivoting, and an EtherHiding fallback that can resolve C2 from the Polygon blockchain. ThreatLabz explicitly flags the Polygon/EtherHiding path as likely still in development — no sample has shipped an embedded smart-contract address, only the function selector 0xd6bd8727 has been observed. Treat EtherHiding as an emerging, unconfirmed capability, not a live TTP to hunt today.

Why the IOCs are unusually solid for a fresh disclosure: The primary Zscaler ThreatLabz post publishes 22 SHA256 values (21 SloppyRAT DLL samples + 1 config.py stager), 5 C2/delivery domains, 1 C2 IP:port, 7 HTTP API paths, and 4 payload URLs. This pack independently re-extracted every hash and network indicator directly from the live Zscaler page (not from an AI summary of it) and cross-confirmed the full set against the Security Boulevard syndication (byte-identical) plus partial corroboration from cybersecuritynews.com (22/22 hashes, all 5 domains, the C2 IP) and gbhackers.com (5/22 hashes, 2 domains). All four hashes supplied in the initial tasking were verified character-for-character against the live source and are correct as given.

Operational limit: Endpoint telemetry cannot prove RC4 protocol semantics, reflective in-memory DLL loading, certificate-pinning bypass attempts, keystroke-level content, or blockchain-resolver contract state — those require memory acquisition, TLS-terminating proxy content, or on-chain lookups. No Falcon tenant was contacted; every CQL card below is STATIC-ONLY.

Defender priority: Run Q01–Q04 for the ClickFix-through-IronPython delivery chain and Q05–Q06 for the confirmed C2 domains/IP/hashes over 30 days first; correlate hits on the same host before escalation. Preserve process tree, dropped files, registry values, and network evidence. Do not resolve, browse to, or otherwise contact any listed C2 domain, IP, or blob-storage URL.

Priority	Why now	Coverage delivered	Key limitation
Hunt the delivery chain and the confirmed C2/IOC set	Fresh (2026-09-10) disclosure, multi-source corroborated hashes and infrastructure, in-the-wild ransomware-adjacent use	9 CQL designs, IOC quick-copy grid, tiered hardening	Static-only; tenant parsing, positive/benign testing, memory and TLS-content evidence are absent

Source and Claim Review

Current-run plain-text snapshots were pulled directly from each live page (HTML-stripped, not AI-summarized) so that hashes and IOCs could be regex-verified byte-for-byte rather than trusted to a paraphrase. Every source was treated as untrusted data; no embedded instruction, command, exploit code, payload, or destination was executed or contacted.

ID	Publisher	Tier	Independence	Accessed	Status
S01	Zscaler ThreatLabz	T1	zscaler	2026-09-13	successful direct-HTML extraction; primary technical source
S02	Security Boulevard	T2	security-boulevard	2026-09-13	successful direct-HTML extraction; full syndication of S01, byte-identical IOC set
S03	Cyber Security News	T2	cybersecuritynews	2026-09-13	successful direct-HTML extraction; independently reproduced the full 22-hash set and all 5 domains
S04	GBHackers	T2	gbhackers	2026-09-13	successful direct-HTML extraction; partial corroboration (5 of 22 hashes, 2 of 5 domains)

Claim	Statement	Sources	Confidence
C01	SloppyRAT is delivered via a ClickFix lure that runs a `finger.exe` command against `finger.linked4x[.]com` to retrieve a batch script.	S01,S02,S03,S04	high
C02	The batch script copies native `curl.exe` to a numerically-named file with a `.com` extension in `AppData` and uses it to download IronPython 3.4.2 from GitHub.	S01,S02	high
C03	The renamed IronPython interpreter executes a zlib-compressed, Base64-encoded Python one-liner that stages CastleLoader and CastleRAT, downloaded from `skipraid[.]com` with User-Agent `K8VGmQTrzX`.	S01,S02	high
C04	A second Python interpreter downloads and runs `config.py` from `hxxps://stro7121[.]blob[.]core[.]windows[.]net/dpp1/config.py`, which reflectively loads a SloppyRAT DLL fetched from the same host (`hostfxr.dll`) using User-Agent `Mozilla/5.0 (compatible; DLLMemLoader/1.0)`, invoking export `f3b980dea`.	S01,S02	high
C05	SloppyRAT communicates over HTTPS/JSON to `api[.]telephoneip[.]net` and `api[.]truesmart[.]org`, and to IP `62.106.66[.]148:443`, via 7 documented API paths; command results and system info are RC4-encrypted then Base64-encoded.	S01,S02,S03	high
C06	SloppyRAT implements 47 built-in commands resembling PowerShell cmdlets but backed by native Win32 API calls, plus two escalation handlers (PSInline via CLR/COM, PSSpoof via PPID-spoofed `powershell.exe`) and WMI-based `cmd` execution.	S01,S02,S03,S04	high
C07	Anti-analysis: three XOR/affine string-obfuscation schemes, 13 runtime-decrypted encrypted code blocks, junk code, DJB2 API hashing over 21 NTDLL functions (10 actually used) resolved via a Hell's-Gate-style indirect-syscall technique, and SHA256 certificate pinning on the DER-encoded server cert.	S01,S02,S03,S04	high
C08	Both persistence mechanisms (Run-key value named `rundll32`; COM hijack via an FNV-1a-derived CLSID) are implemented incorrectly by the malware author and do not function as intended.	S01,S02	high
C09	SloppyRAT can retrieve C2 configuration from the Polygon blockchain (EtherHiding) as a resilience mechanism, but this capability is likely still in development — no sample carries an embedded smart-contract address, only the function selector `0xd6bd8727` has been observed.	S01,S02,S03	medium — capability partially unconfirmed
C10	22 SHA256 hashes (21 SloppyRAT DLL samples, 1 `config.py` script) were independently re-extracted from the live S01 HTML and matched byte-for-byte against S02; S03 reproduces all 22, S04 reproduces 5 of the 22.	S01,S02,S03,S04	high

Contradictions and gaps: No contradictions were found across the four sources — S02 is a verbatim syndication of S01, and S03/S04 are independent extractions that reproduce a strict subset of the same IOC set with no conflicting values. The EtherHiding/Polygon path (C09) is explicitly flagged by the primary source itself as likely incomplete; do not build blocking controls around it. Infrastructure (domains, the C2 IP, and the Azure blob/S3 hosting) can rotate; the hash set is the most durable indicator today.

Hunt Brief and Attack Chain

The scaffold separates queryable endpoint/network behaviors from content-, memory-, and blockchain-level gaps. Each hypothesis retains its evidence basis and a safe validation plan.

Step	Claims	Behavior	Platform	Goal
1	C01	a user runs a ClickFix command that invokes `finger.exe` against `finger.linked4x[.]com`	Windows	Find `finger.exe` retrieval and Finger-protocol (TCP/79) egress
2	C02	a batch script copies `curl.exe` to a numerically-named `.com` file and downloads IronPython from GitHub	Windows	Find the renamed-curl download signature
3	C03	the renamed IronPython interpreter executes an obfuscated zlib/Base64 Python one-liner, staging CastleLoader/CastleRAT from `skipraid[.]com`	Windows	Find the IronPython execution signature
4	C04	a second Python interpreter fetches and runs `config.py`, which reflectively loads the SloppyRAT DLL from Azure Blob/S3	Windows	Find DNS/network activity to the blob-storage hosts
5	C05	SloppyRAT authenticates and polls `api[.]telephoneip[.]net` / `api[.]truesmart[.]org` / `62.106.66[.]148:443`	Windows	Find DNS/network activity to confirmed C2
6	C10	a dropped or loaded file matches one of the 22 confirmed SHA256 hashes	Windows	Match process/file hash telemetry against the IOC set
7	C06	SloppyRAT escalates to PPID-spoofed `powershell.exe` (PSSpoof) when the in-process CLR handler fails	Windows	Find anomalous `explorer.exe`-parented PowerShell
8	C08	SloppyRAT attempts (broken) persistence via a bare `rundll32` Run-key value	Windows	Find the malformed Run-key write
9	C07,C09	in-memory code decryption, RC4 protocol content, and Polygon C2 resolution occur but leave no portable endpoint signature	Windows	Acquire memory / proxy content; treat EtherHiding as unconfirmed

ID	Behavior	Telemetry	Use	Lookback	Validation
H01	`finger.exe` retrieves a ClickFix batch script over TCP/79	ProcessRollup2 / SyntheticProcessRollup2 / NetworkConnectIP4	alert-candidate	30d	Exercise `finger.exe` only against an analyst-controlled inert lab service; baseline any legitimate legacy Finger use before enabling a block.
H02	native `curl.exe` is copied to a numerically-named `.com` file and used to fetch IronPython from GitHub	ProcessRollup2 / SyntheticProcessRollup2	alert-candidate	30d	Reproduce the copy+rename pattern with an inert binary in a lab path; confirm no legitimate deployment tooling renames curl this way.
H03	a renamed IronPython interpreter runs a zlib/Base64-encoded one-liner	ProcessRollup2 / SyntheticProcessRollup2	alert-candidate	30d	Baseline legitimate IronPython/embedded-Python tooling before enforcing; the command-line signature is distinctive but not unique.
H04	DNS/network activity reaches `stro7121[.]blob[.]core[.]windows[.]net`, `backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com`, or `skipraid[.]com`	DnsRequest / SuspiciousDnsRequest / NetworkConnectIP4	alert-candidate	30d	Confirm process attribution before blocking; Azure Blob/S3 are multi-tenant services and the specific hostnames, not the parent domains, are the indicator.
H05	DNS/network activity reaches `api[.]telephoneip[.]net`, `api[.]truesmart[.]org`, or `62.106.66[.]148:443`	DnsRequest / SuspiciousDnsRequest / NetworkConnectIP4	alert-candidate	30d	Treat any hit as high-confidence given single-purpose registered infrastructure; still confirm host/process attribution before isolation.
H06	a process or written file matches one of the 22 confirmed SloppyRAT SHA256 hashes	ProcessRollup2 / PeFileWritten / NewExecutableWritten	alert-candidate	30d	No live-fire test needed for exact-hash matches; validate field availability (`SHA256HashData`) against a benign sample.
H07	`powershell.exe` is spawned with `explorer.exe` as parent but with minimal/absent command-line arguments (PSSpoof signature)	ProcessRollup2 / SyntheticProcessRollup2	hunt	30d	High false-positive risk — baseline shell-extension and Explorer-launched PowerShell shortcuts before treating as high confidence.
H08	a Run-key value named `rundll32` is written with a bare `rundll32(.exe)` string (no path, no export)	AsepValueUpdate / RegGenericValueUpdate	hunt	30d	Reproduce in a lab VM by manually writing the malformed value; confirm no legitimate installer uses an unqualified `rundll32` Run value.
H09	in-memory code decryption, RC4 C2 body content, reverse-SOCKS pivot traffic, and Polygon/EtherHiding resolution occur	memory acquisition, TLS-terminating proxy content, on-chain lookup	gap	30d	Requires memory forensics and approved network content inspection; EtherHiding additionally requires on-chain monitoring the source itself calls unconfirmed.

Affected surface and telemetry

Windows Falcon process, file, DNS, network (IPv4), and registry telemetry. Memory content, TLS/proxy body inspection, and blockchain-resolver monitoring remain out of scope for portable endpoint CQL and are called out as gaps rather than papered over.

Consolidated IOC Table

Provenance: every row below was re-extracted directly from the live S01 (Zscaler) HTML by regex against the stripped page text, then diffed against S02–S04. Nothing here was taken from an AI-generated summary of a source.

Network and delivery infrastructure

Type	Value	Context	Conf	Action
domain	finger.linked4x[.]com	ClickFix stage-1 batch-script host, retrieved via `finger.exe` over TCP/79	High	detect
domain	skipraid[.]com	CastleLoader/CastleRAT download host, User-Agent `K8VGmQTrzX`	High	detect
domain	stro7121[.]blob[.]core[.]windows[.]net	Azure Blob Storage host serving `config.py` and the SloppyRAT DLL (`hostfxr.dll`)	High	detect
domain	backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com	S3 backup host serving the same SloppyRAT DLL	High	detect
domain	api[.]telephoneip[.]net	SloppyRAT C2 domain	High	detect
domain	api[.]truesmart[.]org	SloppyRAT C2 domain	High	detect
ipv4	62.106.66[.]148:443	SloppyRAT C2 IP	High	detect
url	hxxps[://]skipraid[.]com/dsVGmQTrzX/default2	CastleLoader payload URL	High	hunt
url	hxxps[://]stro7121[.]blob[.]core[.]windows[.]net/dpp1/config.py	Python loader/stager URL	High	hunt
url	hxxps[://]stro7121[.]blob[.]core[.]windows[.]net/dpp1/hostfxr.dll	SloppyRAT DLL download URL	High	hunt
url	hxxps[://]backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com/hostfxr.dll	SloppyRAT DLL backup download URL	High	hunt
user-agent	K8VGmQTrzX	CastleLoader retrieval from skipraid[.]com	Medium	hunt
user-agent	Mozilla/5.0 (compatible; DLLMemLoader/1.0)	config.py Python-loader retrieval	Medium	hunt
user-agent	CommandExecutor/1.0	SloppyRAT C2 HTTP client identifier	Medium	hunt
uri-pattern	POST /api/auth · POST /api/systeminfo · POST /api/av_edr · GET /api/poll · GET /api/command/get · POST /api/command/result · POST /api/proxy/ack	SloppyRAT C2 API surface (see §9 for the full table)	Medium	hunt
dll-export	f3b980dea	Export name invoked on the reflectively-loaded SloppyRAT DLL	Medium	hunt

File hashes — SHA256 (22 confirmed, re-verified against live source)

Type	Value	Context	Conf	Action
sha256	9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a	SloppyRAT DLL	High	detect
sha256	8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990	SloppyRAT DLL	High	detect
sha256	ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5	SloppyRAT DLL	High	detect
sha256	680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21	SloppyRAT DLL	High	detect
sha256	bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd	SloppyRAT DLL	High	detect
sha256	607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9	SloppyRAT DLL	High	detect
sha256	7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7	SloppyRAT DLL	High	detect
sha256	6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013	SloppyRAT DLL	High	detect
sha256	00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec	SloppyRAT DLL	High	detect
sha256	93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490	SloppyRAT DLL	High	detect
sha256	971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d	SloppyRAT DLL	High	detect
sha256	a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316	SloppyRAT DLL	High	detect
sha256	518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064	SloppyRAT DLL	High	detect
sha256	3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19	SloppyRAT DLL	High	detect
sha256	2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2	SloppyRAT DLL	High	detect
sha256	1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd	SloppyRAT DLL	High	detect
sha256	eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d	SloppyRAT DLL	High	detect
sha256	cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189	SloppyRAT DLL	High	detect
sha256	c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189	SloppyRAT DLL	High	detect
sha256	4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56	SloppyRAT DLL	High	detect
sha256	466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8	SloppyRAT DLL	High	detect
sha256	f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb	`config.py` Python stager script	High	detect

Host artifacts (behavioral — durable, survive infrastructure rotation)

Type	Value	Context	Conf	Action
registry	HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ rundll32 = `rundll32.exe` (bare, no path/export)	Broken persistence attempt — the malformed value itself is the signature	High	hunt
registry	HKLM\Software\Classes\CLSID\{FNV-1a(computer name)}\InprocServer32	Broken COM-hijack persistence attempt — CLSID is generated, not an existing one, so it is host-specific and not directly matchable, but the pattern (a newly-created CLSID key under this path with a missing/incorrect DLL path) is huntable	Medium	hunt
file-pattern	%TEMP%\*.png (PNG-header-prefixed, XOR-encrypted, non-image content)	PSInline command-result cache file, disguised with a PNG extension	Medium	hunt

Not promoted to atomic IOC: the documented example X-API-KEY header value (af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588) is shown in the primary source as a single sample HTTP request and may be per-build rather than universal; it is retained in §9 as a hunt-context value, not shipped as a confirmed network IOC.

ATT&CK Mapping

Technique rows marked "source-stated" reflect ThreatLabz's own technical description; rows marked "analyst inference" are this pack's mapping of a described behavior onto the closest ATT&CK technique.

Tactic	Technique	Name	Behavior	Basis	Sources
Execution	T1204.004	Malicious Copy and Paste	ClickFix lure runs the initial `finger.exe` command	analyst inference	S01,S02,S03,S04
Command and Control	T1105	Ingress Tool Transfer	finger.exe/curl.exe/IronPython/CastleLoader/CastleRAT/config.py/hostfxr.dll download chain	source-stated	S01,S02
Defense Evasion	T1036.003	Rename Legitimate Utilities	native curl.exe copied to a numerically-named `.com` file	analyst inference	S01,S02
Execution	T1059.006	Python	IronPython and staged Python interpreter execute obfuscated payload code	source-stated	S01,S02
Defense Evasion	T1620	Reflective Code Loading	config.py reflectively loads the SloppyRAT DLL in memory	source-stated	S01,S02
Defense Evasion	T1027	Obfuscated Files or Information	stack/global XOR string obfuscation, affine-cipher Polygon strings, 13 runtime-decrypted code blocks, junk code	source-stated	S01,S02,S03,S04
Defense Evasion	T1027.007	Dynamic API Resolution	DJB2 hashing of 21 NTDLL functions before resolving them at runtime	analyst inference	S01,S02
Defense Evasion	T1106	Native API	Hell's-Gate-style indirect syscalls (parses `B8`/`mov eax` to extract syscall numbers)	source-stated	S01,S02
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	HTTPS/JSON C2 over 7 documented API paths	source-stated	S01,S02,S03
Command and Control	T1573.001	Encrypted Channel: Symmetric Cryptography	RC4-encrypted request/response bodies, Base64-encoded	source-stated	S01,S02
Command and Control	T1090.001	Proxy: Internal Proxy	reverse SOCKS proxy for internal lateral pivoting via `/api/poll`	analyst inference	S01,S02
Command and Control	T1102.002	Web Service: Bidirectional Communication	EtherHiding — C2 resolution via Polygon blockchain (unconfirmed / in development)	analyst inference, flagged unconfirmed	S01,S02,S03
Discovery	T1082	System Information Discovery	`/api/systeminfo`, `Get-ComputerInfo`, `whoami`, `hostname`, and related built-ins	source-stated	S01,S02
Discovery	T1057	Process Discovery	`Get-Process`/`tasklist`/`ps` built-ins	source-stated	S01,S02
Discovery	T1087.001	Account Discovery: Local Account	`Get-LocalUser`/`Get-LocalGroupMember` built-ins	source-stated	S01,S02
Discovery	T1518.001	Security Software Discovery	`/api/av_edr` AV/EDR enumeration endpoint	source-stated	S01,S02,S03
Defense Evasion	T1562.001	Impair Defenses: Disable or Modify Tools	`Set-MpPreference`/`Add-MpPreference` Microsoft Defender tampering built-ins	source-stated	S01,S02
Execution	T1047	Windows Management Instrumentation	`cmd` shell_type executes via `Win32_Process::Create`	source-stated	S01,S02
Execution	T1059.001	PowerShell	PSInline handler loads CLR/COM and calls `PowerShell.Create().AddScript().Invoke()`	source-stated	S01,S02
Privilege Escalation	T1134.004	Access Token Manipulation: Parent PID Spoofing	PSSpoof handler spawns `powershell.exe` with `explorer.exe` as spoofed parent	source-stated	S01,S02
Persistence	T1547.001	Registry Run Keys / Startup Folder	(broken) Run-key value `rundll32`	source-stated	S01,S02
Persistence	T1546.015	Component Object Model Hijacking	(broken) CLSID-based COM hijack fallback	source-stated	S01,S02
Defense Evasion	T1036.008	Masquerading: Masquerade File Type	PSInline command-result cache written with a `.png` extension	analyst inference	S01,S02

Native / Non-CQL Hunts

Hunt	Log source	Logic	Response
ClickFix lure reconstruction	browser history, proxy logs, clipboard policy, user interview	Reconstruct the site visit and pasted `finger.exe` command without re-executing it; preserve original page and timestamps.	Scope the delivery window; brief users on this exact lure pattern only after evidence capture.
HTTP User-Agent / header pivot	web proxy or TLS-inspecting gateway logs	Search proxy logs (not endpoint EDR telemetry, which does not carry HTTP headers) for the User-Agents `K8VGmQTrzX`, `Mozilla/5.0 (compatible; DLLMemLoader/1.0)`, and `CommandExecutor/1.0`, and for the header name `X-API-KEY` on outbound HTTPS to unfamiliar hosts.	Escalate any hit combined with a matching internal process/host from §7.
Memory acquisition and RC4/TLS content review	EDR process tree plus approved memory capture and TLS-terminating proxy content	On a host already corroborated by Q05/Q06, acquire memory to confirm reflective loading and decrypted code blocks; inspect approved TLS-terminated content for the RC4-encrypted JSON body shape. Do not contact or replay any C2 destination.	Confirm active C2 before isolation; preserve volatile memory ahead of remediation.
Polygon/EtherHiding on-chain check (low priority — source flags as unconfirmed)	public Polygon block explorer / RPC query	Only if C2 domains are unreachable and a sample is suspected to use the fallback: look up whether any observed contract address responds to selector `0xd6bd8727`. ThreatLabz has not observed a populated contract as of publication.	Document and monitor only; do not build blocking automation on an unconfirmed capability.

CrowdStrike LogScale CQL Hunt Queries

Falcon cloud (drives “Open in Falcon”): Pick your tenant's cloud first — every "Open in Falcon" button below uses this selection.

Query strategy: Q01–Q04 cover the delivery chain in order; Q05–Q06 hunt the confirmed C2 infrastructure and hash set directly (highest confidence in this pack); Q07–Q09 cover on-host execution/persistence behaviors. Every card remains STATIC-ONLY — no tenant was contacted, no field was validated against a live schema.

Q01 · finger.exe ClickFix retrieval over the Finger protocol

CONF highFP lowCOST low

Looks for: finger.exe launched with the caret-obfuscated, for /f "delims=@"-style command line documented by ThreatLabz, optionally referencing the linked4x[.]com delivery host. Accomplishes: catches the very first observable step of the chain before CastleLoader/CastleRAT/SloppyRAT ever touch disk.

Trace: H01 · A01

// HUNT: finger.exe ClickFix retrieval over the Finger protocol
// HYPOTHESIS: H01
// USE: alert-candidate
// MITRE: T1204.004, T1105
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, CommandLine, ParentBaseFileName, aid
// FALSE POSITIVES: legacy Finger diagnostics, network engineers, compatibility/interoperability testing
// TUNING: inventory legitimate finger.exe owners and exclude by managed host plus approved parent/path, never by filename alone
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^finger\.exe$/i
| CommandLine = /(?:\^.{0,4}\^|delims=@|linked4x)/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Q02 · Renamed curl.exe staging IronPython from GitHub

CONF highFP mediumCOST low

Looks for: a process whose image path ends in .com (curl.exe copied and renamed to a numeric filename) invoked with curl-specific flags and a GitHub IronPython release URL. Accomplishes: targets the documented stage-2 downloader signature, which is unusual regardless of campaign.

Trace: H02 · A02

// HUNT: Renamed curl.exe staging IronPython from GitHub
// HYPOTHESIS: H02
// USE: alert-candidate
// MITRE: T1036.003, T1105
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, ImageFileName, CommandLine, aid
// FALSE POSITIVES: legitimate automation that renames curl for portability, rare packaging tools
// TUNING: scope to hosts with a preceding Q01 hit; exclude approved deployment-tooling paths and signers
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /\.com$/i
| CommandLine = /--ssl-no-revoke/i
| CommandLine = /ironpython/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Q03 · Renamed IronPython executing an obfuscated zlib/Base64 loader

CONF highFP mediumCOST low

Looks for: a process running the documented -c "import base64,zlib,sys,subprocess ... zlib.decompress(base64.b64decode(...))" shape, typically from a numerically-named executable under IronPython.3.4.2\net462. Accomplishes: catches stage-3 execution before CastleLoader/CastleRAT are dropped.

Trace: H03 · A03

// HUNT: Renamed IronPython executing an obfuscated zlib/Base64 loader
// HYPOTHESIS: H03
// USE: alert-candidate
// MITRE: T1059.006, T1027
// CONF: high
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; ImageFileName, CommandLine, aid
// FALSE POSITIVES: legitimate embedded-Python build/deploy tooling that decompresses payloads at runtime
// TUNING: scope to hosts with a preceding Q01/Q02 hit; exclude approved CI/build-agent paths
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| CommandLine = /base64/i
| CommandLine = /zlib\.decompress/i
| CommandLine = /subprocess/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Q04 · DNS/network activity to the SloppyRAT delivery/staging hosts

CONF highFP lowCOST low

Looks for: DNS resolution of the confirmed delivery/staging hostnames (Finger-protocol host, CastleLoader host, and the Azure Blob/S3 hosts serving config.py/hostfxr.dll). Accomplishes: catches the chain from stage 1 through the SloppyRAT DLL fetch, independent of process-level obfuscation.

Trace: H01,H04 · A04

// HUNT: DNS/network activity to the SloppyRAT delivery/staging hosts
// HYPOTHESIS: H01, H04
// USE: alert-candidate
// MITRE: T1105, T1071.001
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: DnsRequest or SuspiciousDnsRequest; DomainName, ContextBaseFileName, aid
// FALSE POSITIVES: none expected — these are single-purpose registered hostnames, not shared cloud front-doors
// TUNING: none required; escalate any hit directly, then correlate with Q01-Q03 process context
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(DnsRequest|SuspiciousDnsRequest)$/
| DomainName = /^(finger\.linked4x\.com|skipraid\.com|stro7121\.blob\.core\.windows\.net|backup-ubt\.s3\.us-east-1\.amazonaws\.com)$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, ContextProcessId_decimal, DomainName, aid])
| sort(@timestamp, order=desc, limit=1000)

Q05 · DNS/network activity to confirmed SloppyRAT C2 (domains + IP)

CONF highFP lowCOST low

Looks for: DNS resolution of api[.]telephoneip[.]net/api[.]truesmart[.]org, or a direct network connection to 62.106.66.148:443. Accomplishes: the single highest-confidence detection in this pack — live C2 contact.

Trace: H05 · A05

// HUNT: DNS/network activity to confirmed SloppyRAT C2 (domains + IP)
// HYPOTHESIS: H05
// USE: alert-candidate
// MITRE: T1071.001, T1573.001
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: DnsRequest, SuspiciousDnsRequest, or NetworkConnectIP4; DomainName / RemoteAddressIP4, RemotePort, ContextBaseFileName, aid
// FALSE POSITIVES: none expected — dedicated C2 domain and IP, not shared infrastructure
// TUNING: none required; treat any hit as high-confidence C2 contact and proceed directly to containment
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(DnsRequest|SuspiciousDnsRequest|NetworkConnectIP4)$/
| (DomainName = /^(api\.telephoneip\.net|api\.truesmart\.org)$/i or RemoteAddressIP4 = "62.106.66.148")
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, ContextProcessId_decimal, DomainName, RemoteAddressIP4, RemotePort, aid])
| sort(@timestamp, order=desc, limit=1000)

Q06 · Process/file hash match against confirmed SloppyRAT SHA256 set

CONF highFP lowCOST low

Looks for: a process execution or written file whose SHA256 matches one of the 22 confirmed hashes in §4/§9. Accomplishes: a direct, exact-match hunt independent of any behavioral heuristic; the highest-confidence card in the pack.

Trace: H06 · A06

// HUNT: Process/file hash match against confirmed SloppyRAT SHA256 set
// HYPOTHESIS: H06
// USE: alert-candidate
// MITRE: T1105, T1620
// CONF: high
// FP: low
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2, PeFileWritten, or NewExecutableWritten; SHA256HashData, aid
// FALSE POSITIVES: none expected for an exact hash match; confirm SHA256HashData is populated for the event type in your tenant
// TUNING: none required; refresh this hash list as new samples are published
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2|PeFileWritten|NewExecutableWritten)$/
| in(SHA256HashData, values=["9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a","8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990","ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5","680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21","bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd","607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9","7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7","6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013","00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec","93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490","971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d","a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316","518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064","3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19","2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2","1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd","eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d","cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189","c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189","4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56","466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8","f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb"])
| table([@timestamp, ComputerName, UserName, ImageFileName, FileName, SHA256HashData, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Q07 · PPID-spoofed powershell.exe (PSSpoof handler)

CONF mediumFP highCOST low

Looks for: powershell.exe reporting explorer.exe as its parent with an empty or near-empty command line — the documented STARTUPINFOEX / PROC_THREAD_ATTRIBUTE_PARENT_PROCESS PPID-spoofing fallback used when the in-process CLR handler fails. Accomplishes: a narrow behavioral pivot for the noisiest of SloppyRAT's three command handlers.

Trace: H07 · hunt-only

// HUNT: PPID-spoofed powershell.exe (PSSpoof handler)
// HYPOTHESIS: H07
// USE: hunt
// MITRE: T1134.004
// CONF: medium
// FP: high
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: ProcessRollup2 or SyntheticProcessRollup2; FileName, ParentBaseFileName, CommandLine, aid
// FALSE POSITIVES: legitimate Explorer shell extensions, shortcuts, and context-menu handlers that launch PowerShell with minimal arguments
// TUNING: scope to hosts with a Q01-Q06 hit; exclude known shell-extension GUIDs/paths after owner review
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(ProcessRollup2|SyntheticProcessRollup2)$/
| FileName = /^powershell\.exe$/i
| ParentBaseFileName = /^explorer\.exe$/i
| CommandLine = /^\s*(powershell(\.exe)?)?\s*$/i
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, TargetProcessId, aid])
| sort(@timestamp, order=desc, limit=1000)

Q08 · Malformed SloppyRAT Run-key persistence write

CONF mediumFP mediumCOST low

Looks for: a Run-key value literally named rundll32 whose data is the bare string rundll32.exe (no DLL path, no export) — the documented broken persistence attempt. Accomplishes: the malformed value is itself distinctive; no legitimate installer writes a Run entry this way.

Trace: H08 · hunt-only

// HUNT: Malformed SloppyRAT Run-key persistence write
// HYPOTHESIS: H08
// USE: hunt
// MITRE: T1547.001
// CONF: medium
// FP: medium
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: AsepValueUpdate or RegGenericValueUpdate; RegObjectName, RegValueName, RegStringValue, aid
// FALSE POSITIVES: none expected for the exact bare-value match; a broader RegValueName-only search would need scoping
// TUNING: none required for the exact-match form below; widen only with an owner-reviewed baseline
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(AsepValueUpdate|RegGenericValueUpdate)$/
| RegObjectName = /\\Software\\Microsoft\\Windows\\CurrentVersion\\Run$/i
| RegValueName = /^rundll32$/i
| RegStringValue = /^rundll32(\.exe)?$/i
| table([@timestamp, ComputerName, UserName, RegObjectName, RegValueName, RegStringValue, aid])
| sort(@timestamp, order=desc, limit=1000)

Q09 · PSInline command-result cache disguised as a PNG

CONF lowFP highCOST low

Looks for: a file written under %TEMP% with a .png extension by powershell.exe, rundll32.exe, or an unsigned process — the documented XOR-encrypted, PNG-header-prefixed command-result cache used by the PSInline handler. Accomplishes: a weak but cheap pivot; genuine PE-file write telemetry does not cover arbitrary non-PE content, so this is necessarily approximate and marked low confidence.

Trace: H09 · hunt-only

// HUNT: PSInline command-result cache disguised as a PNG
// HYPOTHESIS: H09
// USE: hunt
// MITRE: T1036.008
// CONF: low
// FP: high
// COST: low
// TIMEFRAME: 30d — bounded analyst review window
// REQUIRES: TargetFileName and ContextBaseFileName on typed file-write events; coverage of non-PE writes is tenant-dependent
// FALSE POSITIVES: genuine screenshot/cache utilities, browsers, and legitimate PowerShell scripts that write PNGs to %TEMP%
// TUNING: scope strictly to hosts already flagged by Q01-Q07; treat as corroborating evidence only, never as a standalone alert
// FIELD_NOTE: ⚠ validate in tenant — Falcon exposes no generic untyped file-write event; this checks the closest typed write events as a best-effort, low-yield pivot since the PNG-disguised cache is arbitrary non-PE content
// VALIDATION: STATIC-ONLY
#event_simpleName = /^(PeFileWritten|NewExecutableWritten|ZipFileWritten)$/
| TargetFileName = /\\Temp\\[^\\]+\.png$/i
| ContextBaseFileName = /^(powershell|rundll32)\.exe$/i
| table([@timestamp, ComputerName, UserName, ContextBaseFileName, TargetFileName, aid])
| sort(@timestamp, order=desc, limit=1000)

Operationalization and IOA Candidates

Every query has an explicit operational decision. Alert-candidate rows have complete design-only packages; no schedule, notification, IOA, or prevention rule was created.

Query	Use	Decision	Readiness	Rationale
Q01	alert-candidate	alert-package	design-only	Tenant parsing, positive testing, and benign baseline are not recorded.
Q02	alert-candidate	alert-package	design-only	Same as above.
Q03	alert-candidate	alert-package	design-only	Same as above.
Q04	alert-candidate	alert-package	design-only	Same as above.
Q05	alert-candidate	alert-package	design-only	Highest-priority candidate for a scheduled search once tenant-validated; still design-only here.
Q06	alert-candidate	alert-package	design-only	Exact-hash match; strongest candidate for prevention once field coverage is confirmed.
Q07	hunt	hunt-only	design-only	High FP; needs an owner-reviewed shell-extension baseline before any alerting.
Q08	hunt	hunt-only	design-only	Registry field availability and exact-match behavior unverified against a live tenant.
Q09	hunt	hunt-only	design-only	Low confidence, corroborating-evidence use only.

Readiness gate: every benign baseline is unknown and every positive/benign test is planned-not-run. No alert package is deployable as shipped.

Machine-Readable IOC Appendix

Falcon IOC Management CSVbulk import

type,value,action,severity,expiration,description,tags
sha256,9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8,detect,high,2027-03-12,SloppyRAT DLL,campaign:SloppyRAT
sha256,f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb,detect,high,2027-03-12,SloppyRAT config.py stager script,campaign:SloppyRAT
domain,finger.linked4x.com,detect,high,2026-12-12,ClickFix stage-1 batch script host,campaign:SloppyRAT
domain,skipraid.com,detect,high,2026-12-12,CastleLoader/CastleRAT download host,campaign:SloppyRAT
domain,stro7121.blob.core.windows.net,detect,high,2026-12-12,Azure Blob host serving config.py and SloppyRAT DLL,campaign:SloppyRAT
domain,backup-ubt.s3.us-east-1.amazonaws.com,detect,high,2026-12-12,S3 backup host for SloppyRAT DLL,campaign:SloppyRAT
domain,api.telephoneip.net,detect,high,2026-12-12,SloppyRAT C2 domain,campaign:SloppyRAT
domain,api.truesmart.org,detect,high,2026-12-12,SloppyRAT C2 domain,campaign:SloppyRAT
ipv4,62.106.66.148,detect,high,2026-12-12,SloppyRAT C2 IP (port 443),campaign:SloppyRAT

Behavioral Signaturesdurable — survives rotation

# Delivery chain
finger.exe with caret-obfuscated command line ("f^i^n^g^e^r"), for /f "delims=@" ... do %o
curl.exe copied to AppData under a numeric filename with a .com extension
--ssl-no-revoke plus an IronPython GitHub release URL on the command line
-c "import base64,zlib,sys,subprocess ... zlib.decompress(base64.b64decode(...))"

# C2 and network
HTTPS JSON POST/GET to /api/auth, /api/systeminfo, /api/av_edr, /api/poll, /api/command/get,
  /api/command/result, /api/proxy/ack
Authorization: Bearer <session_token> on requests after /api/auth
X-CSRF-Token header on /api/proxy/ack requests
RC4-then-Base64 encoded request/response bodies ({"...":"[Base64(RC4(...))]","encrypted":true})
reverse SOCKS proxy broker initiated via the /api/poll response

# Execution and evasion
powershell.exe with explorer.exe parent and an empty/near-empty command line (PSSpoof)
System.Management.Automation.dll loaded via CLR/COM without a visible powershell.exe process (PSInline)
Win32_Process::Create WMI execution for the "cmd" shell_type
XOR-encrypted, PNG-header-prefixed file written to %TEMP% with a .png extension

# Persistence (both broken/malformed as shipped)
HKCU\Software\Microsoft\Windows\CurrentVersion\Run \ rundll32 = "rundll32.exe" (bare, no path/export)
HKLM\Software\Classes\CLSID\{FNV-1a(computer name)}\InprocServer32 with a missing/incorrect DLL path

Named Tooling & Infrastructurepivot / enrich

# Malware chain
SloppyRAT       final-stage RAT/backdoor analyzed in this pack
CastleLoader    intermediate loader (delivery precursor — see the CastleRAT pack for its own hunt content)
CastleRAT       intermediate RAT stage (delivery precursor — see the CastleRAT pack for its own hunt content)

# DLL export invoked on the reflectively-loaded SloppyRAT DLL
f3b980dea

# User-Agents observed across the chain
K8VGmQTrzX                                CastleLoader retrieval from skipraid.com
Mozilla/5.0 (compatible; DLLMemLoader/1.0)   config.py Python-loader retrieval
CommandExecutor/1.0                       SloppyRAT C2 HTTP client identifier

# Documented example X-API-KEY value (hunt-context only — see callout in section 4)
af4c426b8c4b3b4957875206948eedae09b670f349f2ffb70df7b7a6b06cd588

# EtherHiding / Polygon (source-flagged as likely still in development — do not action as live C2)
contract function selector: 0xd6bd8727
build-time / environment override: LOADER_POLYGON_RESOLVER
no smart-contract address has been observed in any sample as of 2026-09-10

# Zscaler product detections
Win64.Loader.PSInlineLoader
Win64.Rat.SloppyRAT
MDR analytic: WIN-PYTHON-REMOTE-CODE-EXEC

SloppyRAT C2 API Surfacereference — proxy/TLS hunt only

POST /api/auth            {"machine_id":"...","version":"1.0"}                     -> {"token":"..."}
POST /api/systeminfo      {"systeminfo":"[Base64(RC4(...))]","encrypted":true}      -> N/A
POST /api/av_edr          {"...":"[Base64(RC4(av_list))]","encrypted":true}         -> {"success":true|false}
GET  /api/poll?machine_id=<mid>                                                     -> {} or {"action":"close|open","request_id":"..."}
GET  /api/command/get                                                               -> {"command":{...|null,"id":N},"shell_type":"cmd|powershell|auto|inline"}
POST /api/command/result  {"id":N,"status":"...","result":"[Base64(RC4(stdout))]","error":"[Base64(RC4(stderr))]","exit_code":N,"encrypted":true} -> N/A
POST /api/proxy/ack       {"request_id":"..."}                                      -> N/A

Hardening — Tiered and Deployable

Immediate — block the delivery chain and known C2

Block egress on TCP/79 and restrict finger.exe execution (M1037, M1038; CTRL01) — deny outbound Finger-protocol traffic at the perimeter and constrain finger.exe execution via application control for hosts with no documented Finger use case deployable-design Verify: confirm no business-critical legacy service depends on Finger before blocking; run an inert lab test against a controlled Finger server Rollback: restore the prior egress rule and application-control policy from the exported baseline Authority: Zscaler ThreatLabz guidance accessed 2026-09-13.
Add the confirmed domains/IP/hashes to Falcon IOC Management as detect (then prevent after validation) (M1031; CTRL02) — import the §9 CSV, start in detect mode, and promote to prevent once a 7-day benign-baseline window shows no legitimate hits deployable-design Verify: confirm zero benign hits over the baseline window before promoting to prevent Rollback: revert the IOC action to detect via Falcon IOC Management Authority: Zscaler ThreatLabz IOC appendix accessed 2026-09-13.

Near-term — constrain the staging and execution surface

Pilot application-control coverage for renamed/copied system binaries (M1038, M1040; CTRL03) — audit for curl.exe (or any signed system binary) copied to a user-writable path under a different name/extension before a download, then pilot a blocking policy deployable-design Verify: approved packaging/deployment tooling continues to function under audit mode; an inert copy-and-rename test is flagged Rollback: return the cohort to audit mode via the exported policy Authority: Microsoft App Control for Business guidance.
Constrain unmanaged PowerShell escalation paths (M1042, M1026; CTRL04) — apply Constrained Language Mode / AppLocker-style controls to reduce the value of the PSInline (CLR/COM) and PSSpoof (PPID-spoofed powershell.exe) handlers, and alert on explorer.exe-parented PowerShell with empty command lines deployable-design Verify: approved shell-extension and admin workflows continue to pass under the pilot cohort Rollback: restore the previous PowerShell execution policy Authority: Microsoft PowerShell security guidance and Zscaler technical analysis.

Strategic — reduce structural exposure

Retire legacy Finger client where no business owner exists (M1042; CTRL05) — inventory finger.exe use across the estate, assign owners to any exception, and remove or deny execution where no supported dependency remains deployable-design Verify: approved exceptions continue to function; an unowned invocation is prevented or alerted Rollback: reinstall or re-allow only the reviewed signed binary for a time-bounded exception Authority: Zscaler ThreatLabz reporting accessed 2026-09-13.
Centralize process, DNS, network, and registry evidence with extended retention (M1047; CTRL06) — ensure Falcon telemetry (ProcessRollup2, DnsRequest, NetworkConnectIP4, AsepValueUpdate/RegGenericValueUpdate) is retained long enough to reconstruct the full multi-stage chain during an investigation deployable-design Verify: a tabletop reconstruction links ClickFix lure, finger.exe, curl.exe, IronPython, CastleLoader/CastleRAT, and SloppyRAT C2 contact across one test case Rollback: restore prior retention settings only after equivalent evidence capacity exists Authority: CrowdStrike Falcon logging guidance.

Deployable playbook · PB01 · guarded pilot and rollback

Export current egress, application-control, PowerShell, IOC-management, and logging/retention state
Import the §9 IOC set in detect mode
Inventory approved finger.exe, curl-renaming, and IronPython/embedded-Python workflows
Apply audit-mode controls to a limited pilot cohort
Run inert lab fixtures without contacting source infrastructure
Verify expected telemetry and business continuity for the pilot cohort
Promote IOC actions to prevent and expand controls only when exceptions are owned
Roll back through exported policies if a stop condition fires
Retain configuration, events, decisions, and recovery evidence

Design state: no control was canary-tested or deployed. Complete platform, continuity, and approval checks before enforcement.

Containment Runbook

Phase	Trigger	Authority	Owner	Evidence	Recovery
1. Validate and preserve	Q05/Q06 hit (confirmed C2 or hash match), or correlated Q01-Q04/Q07-Q09	SOC lead	SOC analyst	raw events, process tree, dropped files/hashes, DNS/network, registry values	none; preservation is read-only
2. Scope delivery	chain corroborated from ClickFix lure through SloppyRAT C2 contact	incident commander	endpoint and web/proxy responders	browser history, proxy logs, pasted command, related hosts/users	document approved test or continue
3. Isolate affected endpoint	active C2 contact or command execution confirmed	incident commander plus business owner	endpoint operations	isolation time, exceptions, active sessions, business impact	temporary access only under continuity plan
4. Address accounts, network, and lateral pivot	Defender-tampering commands, reverse-SOCKS proxy activity, or lateral connections observed	incident commander plus identity/network owners	identity and network operations	revocations, blocks, destination evidence, owner approvals	restore access through clean reauthentication and reviewed rules
5. Eradicate, recover, re-hunt	scope stable and volatile evidence preserved	incident commander and system owner	endpoint engineering and SOC	rebuild/cleanup record, known-good hashes, fresh Q01-Q09 results	return after no unexplained hits and owner sign-off

Preservation order: raw results, process tree, dropped files and hashes, network/DNS, registry values, memory (if approved), analyst notes, and tool logs. Closure: known-good recovery, explained re-hunt results, and incident-commander plus system-owner approval. Never resolve, browse to, or otherwise contact any C2 domain, IP, or blob-storage URL from this pack during investigation.

Detection Coverage and Validation Evidence

Validation state: STATIC REVIEW PASSED only after the complete local gate suite succeeds (structure/safety, field/event heuristic, CQL heuristic, IOC provenance). This is not Falcon parsing, canary success, schedule creation, or deployment evidence.

Technique / Behavior	Coverage	Query or handoff	Evidence	Limitation
T1204.004 / T1105 (ClickFix + finger.exe retrieval)	Static	Q01	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent
T1036.003 / T1105 (renamed curl.exe / IronPython stage)	Static	Q02	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent
T1059.006 / T1027 (obfuscated Python loader)	Static	Q03	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent
T1105 / T1071.001 (delivery/staging hosts)	Static	Q04	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent
T1071.001 / T1573.001 (confirmed C2 domains/IP)	Static	Q05	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent
T1105 / T1620 (confirmed hash set)	Static	Q06	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent; field availability for SHA256HashData on write events is tenant-dependent
T1134.004 (PPID-spoofed PowerShell)	Static	Q07	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent; high expected FP
T1547.001 (malformed Run-key persistence)	Static	Q08	local structure, field, syntax, provenance, safety review	tenant parser, positive test, benign baseline absent
T1036.008 (PNG-disguised result cache)	Static or gap	Q09	local structure, field, syntax, provenance, safety review	non-PE file-write coverage is tenant-dependent; low confidence as shipped
T1573.001 content, T1620 memory proof, T1090.001 SOCKS content	Gap	native/memory handoff (§6)	none — requires memory acquisition and approved TLS content	not observable from endpoint metadata alone
T1102.002 (EtherHiding / Polygon)	Gap — unconfirmed capability	native on-chain check (§6)	none — source itself reports no populated smart contract observed	do not build detection/blocking around an unconfirmed capability

Recorded evidence and next tests

Every CQL card retains VALIDATION: STATIC-ONLY; no Falcon tenant was contacted.
All 22 SHA256 hashes and all 5 core domains/1 IP were re-extracted directly from live source HTML by regex, not summarized, and cross-checked against 3 independent secondary sources with zero contradictions.
Content, memory, TLS/proxy-body, and blockchain-resolver gaps remain visible and are not papered over.
Next: parse Q05 and Q06 in the intended repository first (highest confidence, lowest FP), verify field availability, then run approved inert positive and 30-day benign tests before promoting any card to prevent.

Hunt Summary Ticket

TITLE:        SloppyRAT hunt — v0.1 Draft
SEVERITY:     high — RAT/backdoor with confirmed C2 infrastructure, likely leveraged by a ransomware-related actor for recon and lateral movement
SCOPE:        Windows Falcon process, file, DNS, IPv4 network, and registry telemetry
HYPOTHESIS:   H01 alert-candidate — finger.exe ClickFix retrieval over TCP/79; H02 alert-candidate — renamed curl.exe stages IronPython; H03 alert-candidate — IronPython executes an obfuscated zlib/Base64 loader; H04 alert-candidate — DNS/network to delivery/staging hosts; H05 alert-candidate — DNS/network to confirmed C2 domains/IP; H06 alert-candidate — hash match against 22 confirmed SHA256 values; H07 hunt — PPID-spoofed powershell.exe (PSSpoof); H08 hunt — malformed Run-key persistence write; H09 gap — in-memory decryption, RC4/TLS content, reverse-SOCKS content, and EtherHiding/Polygon resolution
QUERIES RUN:  Q01-Q06 alert-candidate; Q07-Q09 hunt
DO FIRST:     Q05 and Q06 over 30d, then Q01-Q04 for delivery-chain context
FINDINGS:
GAPS:         tenant parsing, native/memory/TLS-content evidence, positive and benign tests, EtherHiding/Polygon on-chain confirmation
ACTIONS:      SOC validates Q05/Q06 first; platform and endpoint owners preserve and scope evidence for any hit
OWNER:        Security Operations / Detection Engineering / Platform Owner
VERSION:      v0.1 Draft · 2026-09-12 · STATIC REVIEW PASSED

Changelog

v0.1 Draft2026-09-12Initial pack with 9 CQL queries (6 alert-candidate, 3 hunt), 22 source-verified SHA256 hashes plus 5 domains and 1 IP re-extracted directly from live source HTML, full 47-command and anti-analysis technical writeup, IOC quick-copy grid, tiered hardening, and a five-phase containment runbook. Tenant execution is not claimed. EtherHiding/Polygon flagged as an unconfirmed, likely-incomplete capability per the primary source.

References

ID	Publisher	Version/status	Accessed	Use	URL
S01	Zscaler ThreatLabz	successful direct-HTML extraction; primary technical source	2026-09-13	C01-C10	https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks
S02	Security Boulevard	successful direct-HTML extraction; full syndication of S01	2026-09-13	C01-C10	https://securityboulevard.com/2026/09/sloppyrat-a-new-tool-for-ransomware-attacks/
S03	Cyber Security News	successful direct-HTML extraction; independent full-hash corroboration	2026-09-13	C01,C05,C06,C07,C10	https://cybersecuritynews.com/hackers-deploy-new-sloppyrat/
S04	GBHackers	successful direct-HTML extraction; partial hash/domain corroboration	2026-09-13	C01,C06,C07,C10	https://gbhackers.com/hackers-deploy-new-sloppyrat-via-clickfix-to-enable-ransomware-lateral-movement/
REL	HuntPack library	related pack — delivery precursor	—	chain context only	CastleRAT Multi-Stage RAT Hunt