Malware

DCRat

Also known as: DarkCrystal RAT

DCRat is a typical RAT that has been around since at least June 2019.

Indicators of Compromise 7

Domain govtop[[.]]one Domain kkxqbh[[.]]top Filename Mixed Reality.exe Filename lllyd.jpg Filename nvdaHelperRemote.dll IP 204[.]194[.]48[.]250 IP 223[.]26[.]63[.]40

MITRE ATT&CK TTPs 12

T1012
Query Registry
Discovery
 T1027
Obfuscated Files or Information
Defense Evasion
 T1036
Masquerading
Defense Evasion
 T1053.003
Cron
Execution
 T1055
Process Injection
Defense Evasion
 T1059
Command and Scripting Interpreter
Execution
 T1070.004
File Deletion
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1082
System Information Discovery
Discovery
 T1090
Proxy
Command And Control
 T1204.002
Malicious File
Execution
 T1566
Phishing
Initial Access

Source Articles

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT
A suspected China-nexus threat actor is conducting a targeted cyber espionage campaign against Indian taxpayers, tax professionals, and corporate finance teams using spear-phishing emails impersonating the Indian Income Tax Department. The campaign, dubbed Operation DragonReturn, delivers DcRAT via a malicious fake tax filing utility to steal sensitive data and establish persistent access. The attackers use social engineering, DLL side-loading, image-based payload concealment, and Windows service persistence to maintain long-term access to compromised systems.
hacker-news ·3w ago