TF-1811987
high
📛 Threat Title
SectopRAT: URL that delivers a malware payload http://85.239.144.31:6600/v5pfpu6s/DigitalPrintfilFaster.msi
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: SectopRAT (aliases: 1xxbot,ArechClient). Confidence: 100. First seen: 2026-05-13 20:50:32 UTC. Reporter: la_cyber. Tags: SectopRAT.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://85.239.144.31:6600/v5pfpu6s/DigitalPrintfilFaster.msi
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/urls/aHR0cDovLzg1LjIzOS4xNDQuMzE6NjYwMC92NXBmcHU2cy9EaWdpdGFsUHJpbnRmaWxGYXN0ZXIubXNp
IOC database
- Type
- url
- Value
http://85.239.144.31:6600/v5pfpu6s/DigitalPrintfilFaster.msi- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-1811987
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/urls/aHR0cDovLzg1LjIzOS4xNDQuMzE6NjYwMC92NXBmcHU2cy9EaWdpdGFsUHJpbnRmaWxGYXN0ZXIubXNp
domain
digitalprintfilfaster.msi
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/digitalprintfilfaster.msi
IOC database
- Type
- domain
- Value
digitalprintfilfaster.msi- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-1811987
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/digitalprintfilfaster.msi
ipv4
85.239.144.31
IOC database
- Type
- ipv4
- Value
85.239.144.31- First seen
- Last seen
- Attached to this threat
- Appears in
- 5 threats
- Description
- ip:port combination that delivery a malware payload attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
url
http://85.239.144.31:6600/v5pfpu6s/digitalprintfilfaster.msi
IOC database
- Type
- url
- Value
http://85.239.144.31:6600/v5pfpu6s/digitalprintfilfaster.msi- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to SectopRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: SectopRAT (aliases: 1xxbot,ArechClient). Confidence: 100. First seen: 2026-05-13 20:50:32 UTC. Reporter: la_cyber. Tags: SectopRAT.
Remediations (10)
-
web:catalyst.prodaft.com
SectopRAT , also known as ArechClient2, is a stealthy and adaptable remote access trojan (RAT) designed to exfiltrate sensitive user data while evading detection. This analysis explores the malware's technical architecture.
-
web:cybersecuritynews.com
A new malware strain dubbed SectopRAT has emerged, leveraging Cloudflare's Turnstile challenge system as part of its attack methodology.
-
web:gbhackers.com
This malware is notorious for its advanced obfuscation techniques, making it challenging to analyze and detect. Recently, cybersecurity researchers uncovered a new campaign where sectopRAT disguises itself as a legitimate Google Chrome extension named "Google Docs," further amplifying its stealth and data-theft capabilities.
-
web:malwaretips.com
A Bing advertisement designed to look like a link to install NordVPN was found to lead to an installer for the remote access trojan SecTopRAT . Malwarebytes Labs discovered the malvertising campaign on Thursday, with the domain name used for the malicious ad having been created just a day...
-
web:malwr-analysis.com
Arechclient2, also known as sectopRAT , is a Remote Access Trojan (RAT) written in .NET. This malware is highly obfuscated using the calli obfuscator, making its analysis challenging.
-
web:nordvpn.com
SectopRAT is an evasive remote access trojan that steals browser and crypto-wallet data and can operate through hidden secondary desktops.
-
web:social.cyware.com
Security researcher Chris Campbell at Inde has provided an in-depth analysis of SectopRAT , a Remote Access Trojan (RAT) that has been active since early 2019. This malware , built on the .NET framework, is known for its evasive techniques and extensive capabilities for data exfiltration. SectopRAT employs a range of sophisticated techniques to avoid detection and carry out its malicious ...
-
web:www.broadcom.com
Additional Information SectopRAT is a .NET based remote access malware that can also steal information.
-
web:www.malwarebytes.com
The final redirect eventually downloads a large executable disguised as Google Chrome which does install the aforementioned but also surreptitiously drops a malware payload known as SecTopRAT . We have reported this incident to Google, but at the time of writing the fake Google Sites page is still up and running.
-
web:www.rescana.com
Cybercriminals have exploited Google Ads to distribute malware by bundling it with a fraudulent Google Chrome installer. This campaign underscores the pervasive misuse of trusted platforms to disseminate malicious software, specifically the deployment of a remote access Trojan (RAT) known as SecTopRAT .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.