Loading story…
Mandiant published an analysis of Dark Crystal RAT (DCRat), a malware family written in C# and used as a backdoor for remote access to compromised systems. The report highlights DCRat’s role as a modular remote administration tool that can give attackers persistent control over infected hosts and support a range of post-compromise activity.
The malware is notable for its extensible design, which allows operators to expand functionality through additional components and tailor operations after initial access. Mandiant’s write-up adds technical detail on how the backdoor operates, helping defenders better identify, investigate, and respond to intrusions involving DCRat.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant released a blog post analyzing Dark Crystal RAT (DCRat), a C#-based backdoor/RAT, providing technical details about the malware. The publication marks the public disclosure of this analysis in the provided reference.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Analysts examining separate **DCrat** samples found the remote-access trojan using both layered obfuscation and anti-analysis checks to hinder detection. One three-stage `.NET` chain used **ConfuserEx** protection, encrypted high-entropy payloads, and text-based string reconstruction to load successive in-memory modules before reaching the likely final DCrat payload. Researchers manually decoded the final stage’s heavily obfuscated configuration and recovered a command-and-control address at `http://battletw[.]beget[.]tech/`, which had minimal antivirus detections at the time of analysis. A second sample showed DCrat packaged inside a **Nullsoft/NSIS** installer that unpacked and decrypted a loader plus 32-bit and 64-bit DLL payloads. The malware checked for real internet access by resolving the Google Public DNS hostname `google-public-dns-a.google.com`, allowing it to evade sandboxes that simulate connectivity with fake internet responses. After using the DNS result in its decryption flow, the sample allocated memory, invoked `RtlDecompressBuffer`, and injected the final payload into `explorer.exe`; the analysis also noted signs of persistence, privilege use, virtualization checks, and use of a stolen or fake digital certificate.
Aug 15, 2026
Researchers detailed an ongoing **Snip3 crypter** malware campaign that used spear-phishing emails themed as tax statements to launch a multi-stage infection chain. The attacks began with obfuscated **VBScript** and **PowerShell** downloaders that retrieved additional components from remote infrastructure including SQL-backed command sources and public text-hosting services, then established persistence through startup-folder VBS files. Later stages gathered host information, communicated with download servers over HTTP POST, and decrypted further payloads directly in memory to reduce detection. The final Snip3 stage dynamically compiled C# **RunPE** code with CodeDom and used **process hollowing** to inject remote-access trojans into legitimate Windows processes including `AppLaunch.exe`, `RegAsm.exe`, and `regsvcs.exe`. Analysis across samples showed the framework delivering both **DcRAT** and **QuasarRAT**, with one examined payload identified as DcRAT through artifacts including its mutex naming, X.509 certificate fields, and the AES salt string `DcRatByqwqdanchun`. The reporting indicates Snip3 remains an adaptable loader for concealing commodity RATs behind layered scripting, in-memory decryption, and changing command-and-control infrastructure.
Aug 15, 2026
Researchers and incident responders have documented continued abuse of **Quasar RAT** and related malware such as **AsyncRAT** across espionage, phishing, and commodity malware operations. Quasar, an open-source remote administration tool, has been used by multiple threat actors including **APT10** and operators targeting Ukrainian government institutions, where it appeared alongside Sobaken RAT and the custom Vermin backdoor to steal sensitive documents. JPCERT/CC reported that Quasar evolved into a broader **Quasar Family** that includes derivatives such as **XPCTRA, CinaRAT, Void-RAT, and AsyncRAT**, with protocol, encryption, and configuration changes complicating detection and attribution. Recent technical analyses show the malware remains active in varied delivery chains and is often bundled or customized to evade scrutiny. One sample posing as a **Chaos Ransomware** builder was found to contain a clean ransomware builder alongside a hidden **Quasar RAT** payload embedded with **Celesty Binder**, with decrypted configuration revealing C2 `66.63.167.164:55640`, mutex `QSR_MUTEX_M6ajmD3hhoJo7CTsvN`, and persistence-related strings. Separate **AsyncRAT** campaigns used GitHub-hosted payloads, spoofed Thailand Pass lures, ISO/VBScript/PowerShell stages, process injection into `aspnet_compiler.exe`, scheduled-task persistence, antivirus checks, and credential theft. Network defenders have also been warned that Quasar, AsyncRAT, and other RATs frequently use **custom non-HTTP/S C2 protocols** over TCP with encryption, making heuristic traffic analysis and protocol-aware detection critical.
Aug 15, 2026