DCRat 2026 Resurgence: How Fake Legal Docs Hide RAT via DLL Sideloading & Hollowing

A judicial-themed phishing campaign uncovered by Trellix’s Advanced Research Center (ARC) in early 2026 shows how the aging DarkCrystal RAT (DCRat) has been retooled with modern evasion techniques, using legitimate compression libraries and trusted Windows processes as cover for a full remote-access takeover.

The campaign began with a phishing email containing an SVG attachment disguised as a “Resolución Denuncia Jurídica,” a legal complaint notice that impersonates Colombia’s judicial system.

Because SVG files are XML-based and can execute embedded JavaScript, they slip past email gateways that routinely block .exe or .js files.

Victims who opened the attachment were funneled through a fake “Citizen Consultation Portal,” where clicking anywhere triggered a staged download sequence culminating in a password-protected archive, with the password “1601” displayed on-screen to fabricate legitimacy.

Inside the browser, double Base64-encoded JavaScript reconstructed a ZIP file entirely in memory using a Blob function, then saved it to the Downloads folder a technique known as HTML smuggling that leaves fewer artifacts for security tools to flag.

The dropped archive contained a decoy executable bundled with DLLs that mimicked Google’s Brotli compression library, libbrotlidec.dll and libbrotlienc.dll.

This is classic DLL sideloading: Windows’ library search order resolves the attacker’s malicious files instead of genuine ones, letting malicious code execute under the guise of routine compression operations. The loader also dropped a self-copy, dependency DLLs, and a batch script into the user directory, then created a Registry Run key for persistence.

Once running, the binary decrypted a payload directly in memory using XOR and SHR operations across roughly 48 kilobytes of data, revealing valid MZ and PE headers, meaning a fully functional executable materialized without ever touching disk in readable form.

The malware then launched a legitimate Windows utility, AddInProcess32.exe, in a suspended state, manipulated its thread context, and used WriteProcessMemory to inject its own code before resuming execution. The result: a trusted system process silently running attacker-controlled code.

DCRat 2026 Resurgence: How Fake Legal Docs Hide RAT via DLL Sideloading & Hollowing

Deeper analysis of the final .NET payload revealed anti-analysis delays, AMSI bypassing, mutex-based single-instance enforcement, and AES-256-protected configuration data including a mutex string, “DcRatMutex_qwqdanchun,” that definitively ties the sample to DCRat.

The malware’s InitializeClient() routine pulls C2 server details either from a Pastebin link or a hardcoded list, then wraps its connection in TLS. At the time of analysis, the C2 infrastructure was offline, leaving infected machines idle yet armed, repeatedly attempting to reconnect.

“DCRat’s resurgence isn’t about novel code; it’s about novel packaging. Attackers aren’t reinventing malware; they’re re-skinning it in the trusted names of everyday software until defenders stop looking twice,” says a Trellix threat researcher.

Trellix recommends layered defenses: email security to intercept phishing lures, endpoint and EDR tools to catch in-memory execution and disguised sideloaded DLLs, and network security to disrupt C2 beaconing. Organizations should also validate component integrity, monitor unusual module-loading behavior, and maintain aggressive threat-hunting routines, since this campaign demonstrates that trusted process names alone are no longer proof of trustworthiness.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.