ArechClient; Decoding IOCs and finding the onboard browser extension

4 min read

Mar 13, 2025

By: Jason Reaves

Found myself analyzing ArechClient recently and needed a way to automatically decode out the C2 info from lots of samples. By the end of our work we also discovered that the browser extension being delivered by ArechClient is on board the client itself.

The sample I started with:

A very good technical writeup on ArechClient was done back in 2023 by dr4k0nia[1,2]. Using that information I was able to quickly find the function responsible for decoding strings:

internal static string c(int num, int num2, int num3)

{

num += 593;…