Loading story…
Analysts examining separate DCrat samples found the remote-access trojan using both layered obfuscation and anti-analysis checks to hinder detection. One three-stage .NET chain used ConfuserEx protection, encrypted high-entropy payloads, and text-based string reconstruction to load successive in-memory modules before reaching the likely final DCrat payload. Researchers manually decoded the final stage’s heavily obfuscated configuration and recovered a command-and-control address at http://battletw[.]beget[.]tech/, which had minimal antivirus detections at the time of analysis.
A second sample showed DCrat packaged inside a Nullsoft/NSIS installer that unpacked and decrypted a loader plus 32-bit and 64-bit DLL payloads. The malware checked for real internet access by resolving the Google Public DNS hostname google-public-dns-a.google.com, allowing it to evade sandboxes that simulate connectivity with fake internet responses. After using the DNS result in its decryption flow, the sample allocated memory, invoked RtlDecompressBuffer, and injected the final payload into explorer.exe; the analysis also noted signs of persistence, privilege use, virtualization checks, and use of a stolen or fake digital certificate.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A 2023 analysis documented a three-stage .NET malware chain that decrypted and loaded successive in-memory modules before reaching a likely final DCrat payload. The researcher manually decoded the obfuscated configuration and recovered the command-and-control address http://battletw[.]beget[.]tech/.
A malware analysis published on October 2, 2019 examined a DCRAT sample that resolved google-public-dns-a.google.com to verify real internet connectivity and use the DNS response in its decryption flow. The analysis found the final payload included loader and 32-bit/64-bit DLL components injected into explorer.exe.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
embeeresearch.io
Open sourcetccontre.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed an ongoing **Snip3 crypter** malware campaign that used spear-phishing emails themed as tax statements to launch a multi-stage infection chain. The attacks began with obfuscated **VBScript** and **PowerShell** downloaders that retrieved additional components from remote infrastructure including SQL-backed command sources and public text-hosting services, then established persistence through startup-folder VBS files. Later stages gathered host information, communicated with download servers over HTTP POST, and decrypted further payloads directly in memory to reduce detection. The final Snip3 stage dynamically compiled C# **RunPE** code with CodeDom and used **process hollowing** to inject remote-access trojans into legitimate Windows processes including `AppLaunch.exe`, `RegAsm.exe`, and `regsvcs.exe`. Analysis across samples showed the framework delivering both **DcRAT** and **QuasarRAT**, with one examined payload identified as DcRAT through artifacts including its mutex naming, X.509 certificate fields, and the AES salt string `DcRatByqwqdanchun`. The reporting indicates Snip3 remains an adaptable loader for concealing commodity RATs behind layered scripting, in-memory decryption, and changing command-and-control infrastructure.
Aug 15, 2026
Researchers detailed a phishing campaign that used an **SVG attachment** to launch JavaScript in the victim’s browser, drop an HTM file, and abuse the Windows `search-ms` handler with a **WebDAV** path to fetch additional stages. The infection chain pulled a VBScript, an obfuscated batch file, and Python-based payloads protected with **Pyarmor 9**, which analysts reverse engineered by unpacking the runtime’s AES-GCM and marshal customizations. The unpacked Python code decrypted **RC4-protected shellcode**, allocated executable memory, and launched a multi-stage sequence that included a **laZzzy-generated injector** targeting `notepad.exe`, more shellcode, and final **.NET malware** delivering **DcRat, AsyncRAT, XWorm RAT, and PureHVNC**. The tradecraft closely matches activity previously attributed to **DDGroup**, a long-running cybercrime actor tied to phishing campaigns that weaponize `search-ms` and WebDAV to present attacker-hosted files as local search results. Prior reporting linked the group to commodity malware including **XWorm, AsyncRAT, QuasarRAT, BitRat, Remcos, NetWire, Warzone RAT/AveMaria RAT, and ModiLoader/DBatLoader**, along with dynamic DNS infrastructure, open-source tooling such as **Freeze.rs** and **dufs**, and repeated process injection into `notepad.exe`. Researchers said the actor’s infrastructure spans more than 110 dynamic DNS domains and 94 IP addresses since 2019, and that observed domains and URLs from the newer campaign were reported to **URLhaus** to speed blocking.
Aug 15, 2026
A phishing campaign is delivering **DarkCrystal RAT (DCRat)** through weaponized SVG attachments that use **HTML smuggling** to drop a password-protected `7z` archive onto Windows systems. Researchers said the lure impersonates a Colombian legal notice, **“Resolución Denuncia Jurídica,”** and presents a fake citizen consultation portal that instructs victims to open the downloaded archive with the password `1601`, making the staged delivery appear legitimate while shifting malicious assembly into the victim’s browser to evade email inspection. The attack chain uses double-Base64-encoded JavaScript embedded in the SVG, followed by DLL sideloading with files disguised as Brotli components, persistence through a Windows Registry **Run** entry, and process hollowing into `AddInProcess32.exe`. The final payload installs DCRat, a remote access trojan that supports encrypted command-and-control communications, anti-analysis checks, and repeated beaconing to `158[.]94[.]208[.]109`, giving attackers sustained access to compromised hosts.
Aug 17, 2026