Fake PDF Converters Deliver Arechclient2 Information Stealer
Summary
Researchers analyzed fake PDF-to-DOCX sites impersonating pdfcandy[.]com that trick users into running PowerShell, delivering Arechclient2/SectopRAT. The report details the redirect chain, Windows execution stages, IOCs and defenses.
Key points
- Two fake converter sites, candyxpdf[.]com and candyconverterpdf[.]com, impersonated PDFCandy to lure users.
- After simulating a conversion and presenting a CAPTCHA, the sites instructed users to execute a PowerShell command.
- A redirect chain led to an adobe.zip payload hosted at 172[.]86[.]115[.]43.
- The archive contained audiobit[.]exe, which launched cmd[.]exe and MSBuild[.]exe to load the Arechclient2 information stealer.
- Arechclient2, part of the SectopRAT family, can steal sensitive data including browser credentials and cryptocurrency wallet information.
- The report recommends avoiding untrusted converters and PowerShell instructions, scanning downloads, using endpoint and DNS protections, and isolating potentially infected devices.
Article Details
- Attack Vectors
- Fraudulent PDF-to-DOCX converter websites impersonate pdfcandy.com and use a fake processing sequence and CAPTCHA to persuade users to execute a PowerShell command.
- The command follows a redirect chain to download an adobe.zip payload. Its audiobit.exe executable launches cmd.exe, which starts MSBuild.exe to load and execute ArechClient2.
- Defensive Notes
- Use trusted conversion tools from official websites and be wary of converter sites that request PowerShell or command-line execution.
- Keep antivirus and anti-malware software updated; scan downloads and use EDR, DNS filtering, and browser protections to detect or block suspicious activity.
- Verify file types beyond their extensions, consider content disarm and reconstruction, and restrict file uploads by type and size.
- If compromise is suspected, isolate the affected device, change passwords from a clean device, contact financial institutions as appropriate, and report the incident to authorities.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | bind-new-connect[.]click | Domain reported as a known distributor of ArechClient malware. |
| DOMAIN | candyconverterpdf[.]com | Malicious converter domain impersonating pdfcandy.com. |
| DOMAIN | candyxpdf[.]com | Malicious converter domain impersonating pdfcandy.com. |
| IPV4 | 172[.]86[.]115[.]43 | IP address hosting the malicious adobe.zip payload; the article says multiple security vendors flagged it as malicious. |
| SHA1 | 72642e429546e5ab207633d3c6a7e2e70698ef65 | Hash identified for the malicious adobe.zip payload. |
| SHA256 | 51de0b104e9ced3028a41d01dedf735809eb7f60888621027c7f00f0fcf9c834 | Hash identified for the malicious audiobit.exe executable. |
MITRE ATT&CK
T1059.001 · PowerShellThe fraudulent converter prompts victims to execute a PowerShell command that initiates malware delivery.T1059.003 · Windows Command ShellThe article reports that audiobit.exe spawns cmd.exe, which then launches MSBuild.exe.T1127.001 · MSBuildMSBuild.exe, described as a legitimate Windows utility, is weaponized to load and execute ArechClient2.T1204.002 · Malicious FileExecution of the downloaded audiobit.exe starts the reported multi-stage malware chain.
Malware
ArechClient2users. The attack vector involves tricking victims into executing a PowerShell command that installs Arechclient2 malware, a variant of the dangerous SectopRAT information stealer family known for harvestingSectopRATinto executing a PowerShell command that installs Arechclient2 malware, a variant of the dangerous SectopRAT information stealer family known for harvesting sensitive data from compromised systems.
Products
MSBuilda sophisticated multi-stage attack chain where "cmd[.]exe" is spawned, which subsequently launches "MSBuild[.]exe"—a legitimate Windows utility now weaponized to load and execute the ArechClient2 informationPowerShelldomain names to deceive users. The attack vector involves tricking victims into executing a PowerShell command that installs Arechclient2 malware, a variant of the dangerous SectopRAT information stealer