2026-08-21 (FRIDAY): SMARTAPESG CLICKFIX CAMPAIGN LEADS TO TWO RATS
NOTES:
- Zip files are password-protected. Of note, this site has a new password scheme. For the password, see the "about" page of this website.
ASSOCIATED FILE:
- 2026-08-21-SmartApeSG-ClickFix-notes.txt.zip 1.6 kB (1,570 bytes)
- 2026-08-21-SmartApeSG-and-traffic-from-two-different-RATs.pcap.zip 47.7 MB (47,730,265 bytes)
- 2026-08-21-files-from-the-infection.zip 26.9 MB (26,887,968 bytes)
2026-08-21 (FRIDAY): SMARTAPESG CLICKFIX CAMPAIGN LEADS TO TWO RATS TRAFFIC TO SMARTAPESG DOMAIN FOR FAKE CAPTCHA/VERFICIATION PAGE: - hxxps[:]//rowanportico[.]global/identity/realm-xml.js - hxxps[:]//rowanportico[.]global/identity/role-template?xPM7XYCZ - hxxps[:]//rowanportico[.]global/identity/secure-theme.js?18cddb5baf41fce0 URLS GENERATED BY RUNNING THE CLICKFIX TEXT: - hxxp[:]//lagoonandledger[.]com/crol <-- 302 redirect to HTTPS URL - hxxps[:]//lagoonandledger[.]com/crol - hxxp[:]//lagoonandledger[.]com/sepc <-- 302 redirect to HTTPS URL - hxxps[:]//lagoonandledger[.]com/sepc POST-INFECTION TRAFFIC GENERATED BY THE INITIAL RAT: - dns[.]google:443 - legitimate domain, likely used for DNS by the initial RAT - 144.124.242[.]171:443 - encoded or otherwise encrypted TCP traffic (not HTTPS/TLS) POST-INFECTION TRAFFIC CAUSED BY THE FOLLOW-UP RAT: - hxxp[:]//5.252.177[.]69/ <- multiple HTTP POST requests over TCP port 80 ARTIFACTS FROM AN INFECTED WINDOWS HOST: - C:\Users\[username]\AppData\Local\WERCCC.hta -- File description: Initial download after running ClickFix text - C:\Users\[username]\Documents\217417970796890430\217417970796890430.pdf -- File description: Zip archive containing files for legitimate program that side-loads DLL for initial RAT - C:\Users\[username]\AppData\Local\setup.exe -- File description: Installer for follow-up RAT - C:\ProgramData\872413f495df78d2a39228e6c9219ae7\ -- Location description: Directory containing files for legitimate program that side-loads DLL for follow-up RAT SHA256 HASHES: - da2d68e10ea89c520623df66cb1b942914514cada6eb9720b5af9bd1fca502a5 - WERCCC.hta - c99ddd0ba299b3e2c8e7d418e692fee6fa3ce773c24fb4b2e80aa6543e1f2f76 - 217417970796890430.pdf - 883dce16fd4939efbd1296b8984ca67284a23503c9e63f43693f09c4aa5bad62 - setup.exe REGISTRY UPDATE FOR PERSISTENCE OF INITIAL RAT: Key Name: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Class Name:Last Write Time: 8/21/2026 - 3:29 PM Value 0 Name: VAS Advanced Broker Type: REG_SZ Data: C:\Users\[username]\Documents\217417970796890430\VAssessment.exe
IMAGES
Shown above: SmartApeSG script injected into page from a legitimate website.
Shown above: Fake CAPTCHA/verification page generatted by the SmartApeSG traffic, showing the injected ClickFix text to paste into a Run window.
Shown above: Traffic from the infection filtered in Wireshark.
Click here to return to the main page.