SmartApeSG Pushes an Unknown RAT Through ClickFix Lures

Summary

The SmartApeSG campaign uses the ClickFix technique to trick users into running malicious commands through fake CAPTCHA or human verification pages. This action launches an HTA file that downloads and extracts a malicious ZIP archive. The final payload is an unidentified Remote Access Trojan (RAT) that relies on DLL side-loading to establish persistence and communicate with its C2 infrastructure.

Investigation

The investigation included analysis of HTTPS traffic, PCAP files, and malicious archives linked to SmartApeSG activity. Researchers identified malicious JavaScript injected into legitimate websites and traced the infection chain from a clipboard-injected command to the final C2 connection. The RAT was observed communicating with an external IP address over port 443 using encrypted traffic.

Mitigation

Organizations should use web filtering to block known malicious domains, including pewtercanto[.]top and deltaode[.]com. Users should be trained to recognize social engineering methods such as fake CAPTCHAs and ClickFix instructions. Restricting HTA file execution and monitoring for suspicious child processes launched by browsers or Run commands can further reduce the risk.

Response

If SmartApeSG activity is detected, the affected endpoint should be isolated immediately to disrupt C2 communication. Investigators should examine the AppData and Documents directories to identify the RAT and its persistence mechanisms. Endpoint telemetry should also be reviewed for unauthorized HTA execution, clipboard manipulation, and DLL side-loading activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary is executing the SmartApeSG ClickFix campaign. After a user is tricked into a malicious action (often a fake browser update), the system attempts to pull down a malicious HTA file. The HTA then initiates a connection to the C2 infrastructure to download the final RAT payload. To simulate this, we will generate network requests that hit the exact strings defined in the detection logic: deltaode.compo, deltaode.com/wv, and the IP 89.124.79.98.

• Regression Test Script:

    # Simulation script to trigger the SmartApeSG detection rule
    # This script simulates the network requests to the specific IoCs
  
    $urls = @(
        "https://deltaode.compo/payload.hta",
        "https://deltaode.com/wv/malicious.exe",
        "http://89.124.79.98:443/c2_checkin"
    )
  
    foreach ($url in $urls) {
        Write-Host "Simulating request to: $url"
        try {
            # Using Invoke-WebRequest to generate the network telemetry
            # We use -ErrorAction SilentlyContinue because these domains don't actually exist
            Invoke-WebRequest -Uri $url -UseBasicParsing -ErrorAction SilentlyContinue
        } catch {
            Write-Host "Request failed (expected), but telemetry should be generated."
        }
    }

• Cleanup Commands:

    # No permanent changes were made to the system; no cleanup required.
    Write-Host "Simulation complete. No artifacts left on system."