Do Son 
At a Glance
| Malware family | DCRat (DarkCrystal RAT) |
| Threat actor | Not attributed by Trellix; DCRat is a malware-as-a-service tool |
| Target | Users lured with a Colombian judicial theme |
| Delivery vector | Phishing email with a malicious SVG attachment |
| Key capabilities | Remote access, DLL sideloading, process hollowing, encrypted C2 |
| Source | Trellix Advanced Research Center (ARC) |
TL;DR
Trellix analysts uncovered an active DCRat campaign that starts with a booby-trapped SVG file. The attack uses HTML smuggling, DLL sideloading, and process hollowing to hide DarkCrystal RAT inside a trusted Windows process. Every stage needs the victim to click, and the final payload grants attackers full remote control.
Delivery
The campaign begins with a phishing email carrying an SVG attachment. That file looks like a harmless image. Inside, however, it hides embedded JavaScript.
The lure impersonates a Colombian judicial notice titled “Resolucion Denuncia Juridica.” It plays on fear of legal trouble to pressure the victim. A fake portal even supplies a password, 1601, to open the archive. That detail builds a false sense of security.
Trellix calls this a classic case of HTML Smuggling. The technique hides a malicious payload inside a file format that gateways tend to allow. Because SVGs are XML files that can run JavaScript, Trellix describes them as perfect “trojan horses” for bypassing email gateways. This DCRat campaign shows how a plain image can start a full compromise.
Infection Chain
The embedded script decodes double Base64 content. It then rebuilds a ZIP archive entirely in the browser’s memory. The file lands in the downloads folder as a 7z archive.
The archive holds a decoy loader and several fake Brotli libraries. Brotli is a real compression algorithm from Google, so the naming helps the malware blend in. The loader ships with malicious DLLs such as libbrotlidec.dll and libbrotlienc.dll.
DLL Sideloading
When the loader runs, Windows resolves those deceptive libraries instead of genuine ones. As a result, attacker code runs while imports look legitimate. The malware also drops a self-copy, its DLLs, and a batch script, then adds a Run registry key for persistence.
Process Hollowing
Next, a decryption routine rebuilds a hidden executable in memory. The malware starts a legitimate process, AddInProcess32.exe, in a suspended state. It then writes its code into that process and resumes the thread. From the outside, the process still looks normal.
Command and Control and Exfiltration
The end payload is a compact .NET client stub. It decrypts its configuration with an AES-256 key generated at runtime. The mutex name DcRatMutex_qwqdanchun ties the sample to the DCRat family.
The client runs anti-analysis checks and delays execution to dodge sandboxes. It also bypasses AMSI to avoid Windows scanning. To reach its operator, it picks a host and port from a Pastebin link or a built-in list. It then wraps the connection in an SSL stream.
During analysis, the C2 server was offline. Therefore, the malware kept retrying at intervals. When the server is down, the RAT cannot receive commands or steal data, so it idles until the operator returns.
Attribution
Trellix does not name a specific threat actor. DCRat is sold as malware-as-a-service, so many operators use it. Independent coverage from Cyber Security News and GBHackers confirms the campaign details. Notably, Fortinet and Zscaler have documented similar judicial-themed DCRat lures aimed at Colombia, which shows the pattern is reusable.
Defense and Detection Guidance
Start by tightening screening of SVG and HTML email attachments. Inspect unexpected archive downloads, especially password-protected ones. Watch for DLL loads from user-writable folders.
Teams should also monitor for suspicious Run-key changes and hollowed processes. Unexpected code running inside AddInProcess32.exe is a strong warning sign. Trellix recommends stronger application security and better visibility into in-memory execution. Regular threat hunting and component-integrity checks round out the defense.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
