Loading story…
Researchers linked HCrypt, an active crypter-as-a-service, to a multi-stage malware chain that delivered the BitRAT remote access trojan through obfuscated HTA, JavaScript, VBScript, and PowerShell stages. In the analyzed sample, an HTA launcher fetched additional payloads from 135.148.74[.]241, modified the HKCU\Explorer\User Shell Folders\Startup registry value for persistence, and dropped another HTA under C:\ProgramData\3814364655181379114711 before moving to in-memory execution.
The final PowerShell stage decoded two embedded PE files from hex, loaded a .NET injector DLL in memory, and invoked the HH.HH.HHH method to inject the payload into aspnet_compiler.exe. The injector used Windows API functions including LoadLibraryA and GetProcAddress, while the second decoded binary was identified as a UPX-packed BitRAT sample that matched BitRAT YARA signatures after unpacking. The reporting indicates that HCrypt and similar commodity crypters have made process injection a routine capability for malware operators, helping commodity malware evade detection and complicate forensic analysis.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
A blog post analyzed an HTA-based, multi-stage malware chain in which obfuscated scripts launched PowerShell, downloaded additional stages from 135.148.74[.]241, established persistence, and used a .NET injector associated with HCrypt to inject a BitRAT payload into aspnet_compiler.exe. The analysis identified the final payload as UPX-packed BitRAT based on YARA matches and documented indicators including the injector assembly GUID and payload hashes.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that the **Water Basilisk** campaign used a new `HCrypt 7.8` variant to distribute multiple remote access trojans through phishing emails and phishing websites. The intrusion chain began with malicious ISO files carrying obfuscated VBScript stagers, then moved through in-memory VBScript and PowerShell stages that established persistence, deobfuscated payloads, and injected malware into legitimate processes to avoid detection. The final-stage loader was capable of deploying as many as seven RAT families, including **NjRat, BitRAT, NanoCore RAT, QuasarRAT, LimeRAT,** and **Warzone RAT**, while researchers also observed cryptocurrency clipboard hijacker binaries generated through HCrypt. The operation relied on public file-hosting services such as **archive.org**, **transfer.sh**, and **discord.com** to host malware components, and used compromised WordPress sites for phishing kits; researchers said the activity underscored HCrypt's role as an actively developed crypter-as-a-service whose operators appeared to profit both from builder sales and built-in hijacker functionality.
Aug 14, 2026
Researchers detailed an ongoing **Snip3 crypter** malware campaign that used spear-phishing emails themed as tax statements to launch a multi-stage infection chain. The attacks began with obfuscated **VBScript** and **PowerShell** downloaders that retrieved additional components from remote infrastructure including SQL-backed command sources and public text-hosting services, then established persistence through startup-folder VBS files. Later stages gathered host information, communicated with download servers over HTTP POST, and decrypted further payloads directly in memory to reduce detection. The final Snip3 stage dynamically compiled C# **RunPE** code with CodeDom and used **process hollowing** to inject remote-access trojans into legitimate Windows processes including `AppLaunch.exe`, `RegAsm.exe`, and `regsvcs.exe`. Analysis across samples showed the framework delivering both **DcRAT** and **QuasarRAT**, with one examined payload identified as DcRAT through artifacts including its mutex naming, X.509 certificate fields, and the AES salt string `DcRatByqwqdanchun`. The reporting indicates Snip3 remains an adaptable loader for concealing commodity RATs behind layered scripting, in-memory decryption, and changing command-and-control infrastructure.
Aug 15, 2026
Researchers detailed the **CSHARP-STREAMER** remote access trojan as a modular, memory-resident .NET malware used in ransomware intrusions, including cases tied to **Metaencryptor**, **REvil**, **LostTrust**, and **ALPHV/BlackCat**. In observed incidents, attackers launched the RAT through a heavily obfuscated PowerShell stager that performed an **AMSI bypass**, derived an XOR key, retrieved a payload disguised as a PNG, and loaded the .NET assembly directly into memory. The malware then communicated with command-and-control servers over **WebSockets** on multiple ports, with fallback to **ICMP**, using **RC4-encrypted** Protobuf packets. The RAT supports broad post-compromise activity, including command execution, file discovery and exfiltration, keylogging, credential theft, lateral movement, port scanning, process dumping, payload execution, and **Veeam** credential extraction. Investigators found it was often paired with external persistence such as scheduled tasks or services rather than maintaining persistence itself, and in one ransomware case it was used to relay traffic across segmented networks. Detection guidance highlighted forensic artifacts including **Windows Event ID 2004**, a `netsh` firewall rule opening inbound TCP port `6667`, PowerShell Script Block Logging evidence, memory-resident indicators, and the user agent string `websocket-sharp/1.0`, reinforcing assessments that the malware may be customized or provided as a service across multiple ransomware operations.
Aug 15, 2026