SetcodeRat
SetcodeRat is a remote access trojan (RAT) and secret-stealing malware reported by QiAnXin in attacks targeting Chinese-speaking users in China. It has been propagated via malvertising since at least October 2025 and is described as Telegram-based, with the ability to communicate either through Telegram or a conventional C2 server for tasking. The malware includes regional gating logic and only proceeds when the victim system language is set to Chinese locales including Zh-CN, Zh-HK, Zh-MO, or Zh-TW; it also terminates if it cannot connect to a Bilibili URL, indicating additional environment validation.
For execution, SetcodeRat uses DLL sideloading: it launches pnm2png.exe to load zlib1.dll, which decrypts qt.conf to run the RAT payload. Reported capabilities include taking screenshots, logging keystrokes, reading and setting folders, starting processes, executing cmd.exe, establishing socket connections, collecting system and network information, and updating itself. Reporting states that hundreds of computers, including government and enterprise systems, were infected within one month. High-confidence artifacts and identifiers mentioned in the source include pnm2png.exe, zlib1.dll, qt.conf, Telegram-based communications, and the Bilibili connectivity check.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SetcodeRat is a Telegram secret stealing trojan, customized for Chinese-speaking regions.
SetcodeRat is a Trojan targeting Chinese-speaking regions, designed to steal Telegram secrets and potentially other sensitive information.
A RAT targeting Chinese-speaking regions, distributed via malvertising and disguised as legitimate installers. It verifies the victim's region and system language, uses DLL sideloading for execution, and supports data theft, screenshot capture, keylogging, and C2 communication via Telegram or conventional servers.
Telegram-based remote access trojan used to target Chinese users.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.