SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz - Zscaler, Inc.

In June 2026, Zscaler ThreatLabz identified a new malware family, tracked as SloppyRAT, that is likely leveraged by a ransomware-related threat actor. ThreatLabz observed SloppyRAT being delivered through a multi-stage ClickFix infection chain. The malware supports a variety of features including a large number of built-in PowerShell-like commands, encrypted code blocks, EtherHiding for command-and-control (C2) resolution through the Polygon JSON-RPC protocol, and multiple anti-analysis techniques. Beyond SloppyRAT’s capabilities, the malware is notable because the codebase includes numerous software flaws, which suggest that it is still under development.

In June 2026, ThreatLabz identified SloppyRAT , a new malware family likely used in ransomware attacks to establish a foothold for lateral movement.

SloppyRAT uses several techniques to make analysis more difficult, including encrypted code blocks that are decrypted and executed at runtime, as well as junk code and indirect system calls.

SloppyRAT has an EtherHiding implementation as a backup channel for C2, which can be used to hinder disruption efforts.

SloppyRAT uses certificate pinning to prevent networking monitoring solutions from using Man-in-the-Middle (MiTM) attacks to inspect TLS traffic.

SloppyRAT has a large number of built-in PowerShell-like commands that provide attackers with remote access.

The code contains software bugs that impact some of SloppyRAT’s features.

In the following sections, ThreatLabz provides a technical analysis of SloppyRAT, including its infection vector, anti-analysis techniques, network protocol, and command execution functionality.

ThreatLabz observed SloppyRAT distributed via a ClickFix style lure, using finger.exe to download and execute a batch script from finger.linked4x[.]com as shown in the command line below:

The finger.exe utility uses the Finger protocol, which typically communicates with servers over TCP port 79. Most corporate environments do not require this tool or protocol. Therefore, organizations can block egress traffic on port 79 and block the execution of the finger.exe utility.

The downloaded batch script copies (the native Windows) curl.exe to the AppData directory using a filename that consists of numbers and a .com extension. The renamed curl executable is then used to download IronPython from GitHub using the following command line:

IronPython is renamed and then used to execute zlib compressed Base64-encoded Python code via the command line shown below, which downloads and runs additional stages, leading to the deployment of CastleLoader, and ultimately, CastleRAT.

Note that the CastleLoader and CastleRAT components were downloaded from skipraid[.]com using the User-Agent string K8VGmQTrzX . Alongside CastleRAT, the threat actor chose to deploy an additional Python interpreter that was downloaded and written to disk (instead of re-using the IronPython interpreter). The threat actor then used the pythonw.exe interpreter to download and execute a Python script from hxxps://stro7121.blob.core.windows[.]net/dpp1/config.py .

The config.py script’s purpose is to download and reflectively load a DLL in memory. This script downloaded a SloppyRAT DLL from hxxps[://]stro7121[.]blob[.]core[.]windows[.]net/dpp1/hostfxr[.]dll and invoked the DLL export name f3b980dea . The config.py script used the distinctive User-Agent Mozilla/5.0 (compatible; DLLMemLoader/1.0) . The SloppyRAT DLL that was downloaded from this URL is the sample that was analyzed in the following sections.

SloppyRAT employs several anti-analysis techniques to hinder analysis and detection.

SloppyRAT uses three string obfuscation methods. The first decodes strings constructed on the stack, the second decodes global values, and the third decodes strings related to Polygon C2 communications.

Stack strings are obfuscated with XOR using a unique 4-byte key for each string. Global values are decrypted using XOR, but with a single-byte key that changes per string. These strings include configuration values such as the SHA256 certificate hash, C2 URL, encryption key (which serves several purposes, including network communication) and an API key used for authentication.

The Polygon resolver’s C2 strings use an affine cipher loop algorithm. Affine ciphers typically use the number 26 as a modulus to represent the English alphabet. However, SloppyRAT uses the modulus 127, which is the size of the ASCII table. Because the number 127 is coprime with all the numbers from 1 to 126, the algorithm avoids collisions and remains reversible. The following Python code implements the decryption algorithm, with A and B representing the keys that change for each string:

Encrypted code blocks

SloppyRAT also uses code encryption to hinder analysis. A total of 13 functions are decrypted and executed at runtime. Information for each encrypted code block is stored in a table with the following structure:

SloppyRAT uses the following XOR-based algorithm to decrypt each code block:

The functions are decrypted in place after the section permissions are changed to read/write/execute. The code remains decrypted in memory until the process terminates. Although the code can re-encrypt the functions with a different key (and SloppyRAT caches a copy of the plaintext for this purpose), this capability is not currently used, as shown in the figure below.

Figure 1: SloppyRAT runtime code decryption routine.

The 13 encrypted functions primarily support the malware’s initialization and network communication. The purpose of these functions is described below:

Reads configuration global values and enters the communication loop.

Dispatches tasks to the internal command execution handlers.

Generates the machine ID and the session nonce used as a request ID for SOCKS communication.

Creates a reverse SOCKS worker thread.

Stops the reverse SOCKS worker thread.

Requests a command from the C2 and parses the JSON response into an internal task structure.

Generates a folder path for persistence in %LOCALAPPDATA% .

Starts the C2 worker thread.

Stores the returned session token in a global variable for subsequent authenticated requests.

Runs the C2 worker loop.

Checks whether the resolved NTDLL syscall gadget begins with 0F 05 .

Stops the C2 worker thread.

Reads 4 configuration global values from the .rdata section.

The SloppyRAT malware author inserted junk code throughout the program to hinder static analysis and evade signature-based antivirus detection. Most of this junk code serves no meaningful purpose such as allocating and freeing memory, calling Windows API functions, and performing bitwise operations. An example of the junk code is shown below.

Figure 2: Example of SloppyRAT junk code.

Indirect system calls and API hashing

Like many modern malware families, SloppyRAT uses a Hell’s Gate-style technique to avoid security products that hook various Windows API functions. SloppyRAT first resolves the DJB2 hashes associated with the functions listed in the table below:

NtAllocateVirtualMemory

NtProtectVirtualMemory

NtWaitForSingleObject

NtQueryInformationProcess

NtQueryInformationToken

NtQuerySystemInformation

Table 1: Windows API functions resolved by SloppyRAT using DJB2 hashes.

After identifying an export by its hash, SloppyRAT reads the start of the function. The malware searches the NTDLL stub for the opcode B8 ( mov eax ), extracts that 4-byte immediate value, and stores the syscall number in an internal table. The following assembly code shows how one of these NT functions can be parsed to obtain the syscall number.

When SloppyRAT invokes the corresponding function, it does so through a direct syscall instead of using the Windows API. Note that SloppyRAT only uses the following 10 (out of the 21) resolved functions in the code:

NtAllocateVirtualMemory

NtProtectVirtualMemory

NtWaitForSingleObject

Some SloppyRAT variants do not establish persistence. The variants that do, use one of two methods:

Adding an entry under the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key with the name rundll32 .

If the registry entry cannot be set, then SloppyRAT appears to be designed to perform COM hijacking by adding the malware path to the HKLM\Software\Classes\CLSID\{[clsid]}\InprocServer32 registry key instead.

However, both methods appear to be implemented incorrectly. The Run registry value is set to execute rundll32.exe without specifying the necessary path to the SloppyRAT DLL and invoking the required export.

The figure below shows SloppyRAT’s failed attempt to establish persistence using the Run registry key.

Figure 3: SloppyRAT’s failed attempt at establishing persistence via the Run registry key.

For COM hijacking to work, SloppyRAT must replace an already existing CLSID with a value to execute its own DLL. However, the malware generates a completely new CLSID based on the FNV-1a hash of the computer name, defeating the purpose of the technique. Similar to the Run registry code, SloppyRAT also doesn’t provide the correct path to the DLL and export in the CLSID value.

The figure below shows SloppyRAT’s unsuccessful attempt to establish persistence through COM hijacking.

Figure 4: SloppyRAT’s failed COM hijacking attempt.

Network communication

SloppyRAT communicates over HTTPS with JSON-formatted messages. Depending on the sample, the C2 URL may be embedded in the configuration or retrieved from the Polygon blockchain through EtherHiding .

During the TLS handshake, SloppyRAT compares the server certificate against a hardcoded SHA256 hash. If the hash value does not match, SloppyRAT closes the connection, preventing network monitoring via TLS MiTM attacks. Older samples perform the TLS handshake through raw SChannel sockets, while newer samples use the WinHTTP API and retrieve the leaf certificate through WinHttpQueryOption. SloppyRAT computes the SHA256 hash of the entire DER-encoded certificate, rather than just the public key.

After completing the certificate-pinning check, SloppyRAT sends an authentication request with a hardcoded API key value in the X-API-Key HTTP header. The request also includes a machine ID (generated using an FNV hash of the volume serial number, volume name, file system name, and computer name) and a version number that may represent either the malware or protocol version. An example request is shown below.

The SloppyRAT C2 server returns a session token, which the malware includes in subsequent requests using the Authorization Bearer HTTP header. For proxy-connection acknowledgements, SloppyRAT sends the token in the X-CSRF-Token header instead. The protocol supports authentication, system information reporting, and task execution. The C2 endpoints available are listed in the table below:

{"machine_id":"[machine_id]","version":"1.0"}

{"token":"[session_token]"}

Authentication request

{"systeminfo":"[Base64(RC4(system_info))]","encrypted":true}

One-shot host fingerprint

{"[field]":"[Base64(RC4(av_list))]","encrypted":true}

{"success":true/false}

Sends antivirus/EDR information

/api/poll?machine_id=(mid)

{} or {"action": "close/open", "request_id":"..."}

Heartbeat and reverse SOCKS broker initiator

{"command": {...|null, "id":N}, "shell_type": "cmd"|"powershell"|"auto"|”inline”}

{"id": N,"status": "completed" | "failed" | "timeout","result": "[Base64(RC4(stdout))]","error": "[Base64(RC4(stderr))]","exit_code": [int],"encrypted": true}

Sends executed command results

{"request_id":"[request_id]"}

Reverse-SOCKS proxy confirmation response

Table 2: SloppyRAT C2 communication endpoints.

The command results and system information are sent encrypted with RC4 using a hardcoded key and then Base64-encoded. SloppyRAT also supports a separate reverse SOCKS connection through the /api/poll response, allowing the operator to use the infected host as a proxy to access other systems on an internal corporate network for lateral movement.

To improve resilience against takedowns, SloppyRAT can retrieve C2 information from the Polygon blockchain network. However, this capability may still be in development because ThreatLabz has not identified any samples containing a smart contract address. Only the contract selector 0xd6bd8727 has been observed. The smart contract address can be supplied either in the configuration at build time or through the LOADER_POLYGON_RESOLVER environment variable.

Each command received from the C2 server is formatted as JSON and contains a shell_type field with one of the following values:

auto or inline (depending on the variant)

The shell_type value is paired with a command string that determines which command handler SloppyRAT uses. The powershell value selects one of three increasingly-noisy command handlers (i.e. most likely to reduce the chances of triggering an EDR detection) to execute commands. The cmd value executes commands through WMI. The auto value chooses the appropriate command handler based on the command sent, while inline is a newer option that replaces auto in some variants that invokes the PSInline PowerShell handler described later.

Built-in PowerShell-like command execution

If the shell_type is set to powershell , SloppyRAT first checks whether the command string matches one of 47 built-in commands. Although their names resemble PowerShell cmdlets, these commands are implemented in C++ and interact directly with Windows APIs rather than PowerShell. The table below lists these commands.

Windows APIs / Mechanism

Retrieves the current user and computer name.

GetUserNameW + GetComputerNameExW

Retrieves the computer's DNS hostname.

GetComputerNameExW(ComputerNameDnsHostname)

Retrieves the USERNAME environment variable.

GetEnvironmentVariableW("USERNAME")

Retrieves the COMPUTERNAME environment variable.

GetEnvironmentVariableW("COMPUTERNAME")

[Environment]::UserName

Retrieves the logged-in username.

[Environment]::MachineName

Retrieves the NetBIOS machine name.

[Environment]::OSVersion / uname

Retrieves the operating system (OS) version.

Retrieves the OS product name (e.g. "Windows 10 Pro")

Win32_OperatingSystem.Caption

[Environment]::Is64BitOperatingSystem

Determines whether the OS is 64-bit.

[Environment]::Is64BitProcess

Determines whether the OS is 64-bit.

No API involved (sizeof(void*)==8)

Retrieves the path to %WINDIR%\System32.

Retrieves the number of logical CPUs.

GetNativeSystemInfo → dwNumberOfProcessors

Retrieves the process's current working directory.

Retrieve the number of milliseconds since boot.

[System.Net.Dns]::GetHostName() / domain

Retrieves the host name or domain name

pwd / Get-Location / gl

Prints the current working directory.

cd / Set-Location / sl / chdir / set

Changes the current working directory.

ls / dir / gci / Get-ChildItem

Lists directory contents.

FindFirstFileW + FindNextFileW + FindClose

cat / type / Get-Content / gc

Reads a file's contents.

CreateFileW + ReadFile + CloseHandle

New-Item / mkdir / md / ni

-ItemType Directory [path]

Creates a directory (recursively when needed).

CreateDirectoryW + SHCreateDirectoryExW

Remove-Item / del / erase / ri / rm

Deletes a file or directory tree.

DeleteFileW / RemoveDirectoryW (recursive via FindFirstFileW)

Retrieves all environment variables.

GetEnvironmentStringsW + FreeEnvironmentStringsW

$env:LOCALAPPDATA / APPDATA / TEMP / USERPROFILE / WINDIR / SystemRoot / SystemDrive

Reads user or system folder paths.

GetEnvironmentVariableW / GetTempPathW / SHGetFolderPathW

[Environment]::GetEnvironmentVariable(name)

Returns an environment variable by name.

GetEnvironmentVariableW

Get-Process / ps / tasklist / gps

Enumerates running processes.

K32EnumProcesses + OpenProcess + GetModuleFileNameW + GetProcessTimes

Enumerates Windows services.

Dynamic advapi32: OpenSCManagerW + EnumServicesStatusExW + CloseServiceHandle

Start-Process / saps / start / call / &

Spawns a new process.

Retrieves system information.

RtlGetVersion (dyn) + GetNativeSystemInfo + GlobalMemoryStatusEx + GetComputerNameExW

Retrieves the current local date and time.

GetLocalTime + SystemTimeToFileTime

[Environment]::TickCount

Retrieves the tick count since boot.

Retrieves PowerShell version information.

RtlGetVersion checked against hardcoded product-name list (Win 7/8/8.1/10/11)

Enumerates local user accounts.

Dynamic netapi32: NetUserEnum + NetApiBufferFree

Enumerates members of a local group (e.g., Administrators).

Dynamic netapi32: NetLocalGroupGetMembers + NetApiBufferFree

[registry path] (HKLM:\... / HKCU:\... / HKCR:\...)

Reads a registry key's values.

RegOpenKeyExW + RegQueryValueExW + RegEnumValueW + RegCloseKey

Test-NetConnection / tnc

-ComputerName [host] -Port [port]

Performs a TCP connectivity probe.

WSAStartup + GetAddrInfoW + socket + ioctlsocket + connect + select + closesocket

Performs a TCP-based ping without ICMP.

socket + connect + select

Performs a DNS lookup for A and AAAA records.

WSAStartup + GetAddrInfoW + FreeAddrInfoW

Queries Microsoft Defender status.

CoCreateInstance(WbemLocator) → ROOT\Microsoft\Windows\Defender → ExecQuery MSFT_MpComputerStatus

Set-MpPreference / Add-MpPreference

-[Setting] [Value] (e.g. -DisableRealtimeMonitoring $true)

Modifies Microsoft Defender configuration.

CoCreateInstance(WbemLocator) → ExecMethod on MSFT_MpPreference

gwmi / Get-WmiObject / gcim / Get-CimInstance

Queries an arbitrary Windows Management Instrumentation (WMI) class(e.g., Win32_Process).

CoInitializeEx + CoCreateInstance(WbemLocator) → ROOT\CIMV2 → ExecQuery → IEnumWbemClassObject

findstr / dir / (WMI-translated)

Searches the filesystem by name or pattern using WMI.

same WMI path → SELECT Name,FileSize FROM CIM_DataFile WHERE ...

(New-Object Net.WebClient).DownloadFile

Downloads a file from a URL and writes it to the specified destination on disk.

Dynamic WinHTTP: WinHttpOpen/Connect/OpenRequest/SendRequest/ReceiveResponse/ReadData + CreateFileW/WriteFile

WScript.Shell.CreateShortcut(...)

[lnk path] + target properties

Creates an .lnk shortcut (persistence helper).

CoCreateInstance(CLSID_ShellLink, IID_IShellLinkW) + IShellLinkW::SetPath/... + IPersistFile::Save

echo / Write-Output / Write-Host

Echoes text back to the operator.

no API involved (string passthrough)

iex / Invoke-Expression

Re-dispatches a string as a command.

no API involved (recursive call into the dispatcher with the expression as input)

Returns the last command's exit code.

-eq / -ne / -gt / -lt

Compares integer or string values

Table 3: Built-in commands implemented by SloppyRAT.

ThreatLabz identified SloppyRAT variants that omit these built-in commands, reducing the size of the binary by approximately 400KB.

PowerShell (PSInline) execution via CLR

If the shell_type is set to powershell (or inline in some variants) but the command does not match a built-in command, SloppyRAT loads the .NET common language runtime (CLR) execution engine ( clr.dll ) through COM objects. It then loads System.Management.Automation.dll and calls PowerShell.Create().AddScript(cmd).Invoke() to execute the command. The SloppyRAT code internally refers to this command handler as PSInline .

The handler stores the most recent command results in a temporary file in the %TEMP% directory. The filename uses a PNG extension to disguise itself as an image file. The contents of the file include a PNG header and the command results, which are encrypted via XOR with the hardcoded key (also used for network communication) in SloppyRAT’s configuration.

PPID-spoofed PowerShell (PSSpoof) execution

This command execution path, referred to internally as PSSpoof , is only used when the .NET CLR instantiation through the PSInline command handler fails. This may happen if .NET is not installed or the COM interface is incompatible with the existing .NET installation. In this case, SloppyRAT spawns an actual powershell.exe process but with explorer.exe as the parent process ID. Parent process ID spoofing is accomplished by constructing a STARTUPINFOEX structure with the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute pointing to a handle for the explorer.exe process, then calling CreateProcessW .

WMI command execution

SloppyRAT also supports the value cmd for the shell_type , which launches a command-line through WMI using Win32_Process::Create .

SloppyRAT includes extraneous functionality, unusual design choices, and chaotic code. However, SloppyRAT’s capabilities are sufficient to support information gathering, reconnaissance, and lateral movement for ransomware-related attacks. The malware author also implemented a number of techniques to hinder static code analysis, endpoint detection, and network monitoring solutions. Organizations should take measures to ensure they have the proper security solutions in place to detect and prevent ClickFix-style attacks and subsequent payloads.

Zscaler’s multilayered cloud security platform detects indicators related to SloppyRAT at various levels. The figure below depicts the Zscaler Cloud Sandbox, showing detection details for SloppyRAT.

Figure 5: Zscaler Cloud Sandbox Report for SloppyRAT.

In addition to sandbox detections, Zscaler’s multilayered cloud security platform detects indicators related to the threat described in this blog with the following threat names:

Win64.Loader.PSInlineLoader

Zscaler MDR also detects this threat on endpoints using indicators of compromise and this detection analytic:

WIN-PYTHON-REMOTE-CODE-EXEC

Indicators Of Compromise (IOCs)

9f84cfcf988530941555d1cb7780a091743cf567396201eff7731f5475768f9a

SHA256 of SloppyRAT DLL

8774533134d9d1514106c4090a0c5bccab4550facdcfe03f4e02b9764343a990

SHA256 of SloppyRAT DLL

ff142fc192daa2a83bc565e5b38ebbe05561f3a19c7fc2d08e38c97e1986bbc5

SHA256 of SloppyRAT DLL

680c3a9f5fdddfcc34856c7a67d21bbdd2b47d70bdfb829ff59cfa0e3bc72d21

SHA256 of SloppyRAT DLL

bdcf8fe230e23692b658b62b6547374e2234f2a497b19d26637018a1839e6dfd

SHA256 of SloppyRAT DLL

607212cfe73c5c84b2dd95b2c0ff37a47f4c8aad08e6d5cbb7c19a62c6b765f9

SHA256 of SloppyRAT DLL

7bb025b426ae6ccbc170fbca58634b8dd77a61447e48dabe9c2e2fb0d339d8b7

SHA256 of SloppyRAT DLL

6d50bb50d4e7d6ac36ca6d2761f382be8e1ddbebf3cdf4733cf989ba291f9013

SHA256 of SloppyRAT DLL

00c116e498799dc831c8aeb602349296c4b9325535d674fe2b6e2e091878dcec

SHA256 of SloppyRAT DLL

93273ea09bd9df881a594db8cfe1b1bbc54f40f623f44427278ae96fb9b46490

SHA256 of SloppyRAT DLL

971f25f84be88c4fd304d555b5e3da12f6b368e4b9ba0943961ff21ba6fa4d4d

SHA256 of SloppyRAT DLL

a13fcbb0870f2fabb7e0a8c757ee3b763bd4a4b0cdf59eeff981d8e307fcf316

SHA256 of SloppyRAT DLL

518cd57a303ff7ac2b5c4c8439aa5bcbf9a287d4653de7b76051bde73a94d064

SHA256 of SloppyRAT DLL

3a8994928f512fffcb32e117ac45e0ee093541d99a9dba5f69a264f7f3054b19

SHA256 of SloppyRAT DLL

2f3d95de716f330fad2330d8787ebdbecb3322453bdc41b2113427f9f92d32d2

SHA256 of SloppyRAT DLL

1439990ff65364a0f608a322aa3a493bc1683cb5fc30cffc44948da29623fffd

SHA256 of SloppyRAT DLL

eaa52d2d6d4daf29157e8e813247fb2e92797324230ee42c79f7861b2f5c341d

SHA256 of SloppyRAT DLL

cb9930d0cde5bf8e8a7ad08fe2c60b937c7beaf9ab51b03191dfcaba40b7b189

SHA256 of SloppyRAT DLL

c0ef62a2d5ca11c2eedad3561d5d1d8b6e9847aa6b8613493e5bc233ece3d189

SHA256 of SloppyRAT DLL

4ecb2d06510dfee1b67f5d9a68c60f6d09ddb5be36cc1766a41d77c5b89d3a56

SHA256 of SloppyRAT DLL

466f9b8dce77b3a026fe4f833aa4949784fb854bea4137e52609e857d439dec8

SHA256 of SloppyRAT DLL

f534a957edec74d69081665309311b791b6d11a3221fffa67744812d73ad98eb

config.py Python Script

finger.linked4x[.]com

ClickFix script domain

hxxps[://]skipraid[.]com/dsVGmQTrzX/default2

hxxps[://]stro7121.blob.core.windows[.]net/dpp1/config.py

hxxps[://]stro7121.blob.core.windows[.]net/dpp1/hostfxr.dll

hxxps[://]backup-ubt[.]s3[.]us-east-1[.]amazonaws[.]com/hostfxr[.]dll

stro7121.blob.core.windows[.]net

Mozilla/5.0 (compatible; DLLMemLoader/1.0)

Python Loader User-Agent

api.telephoneip[.]net

Was this post useful?

Disclaimer: This blog post has been created by Zscaler for informational purposes only and is provided "as is" without any guarantees of accuracy, completeness or reliability. Zscaler assumes no responsibility for any errors or omissions or for any actions taken based on the information provided. Any third-party websites or resources linked in this blog post are provided for convenience only, and Zscaler is not responsible for their content or practices. All content is subject to change without notice. By accessing this blog, you agree to these terms and acknowledge your sole responsibility to verify and use the information as appropriate for your needs.

Get the latest Zscaler blog updates in your inbox