DCRAT Impersonating the Colombian Government
Essential information
- Published
- 02/07/2025 15:23
- Modified
- 02/07/2025 16:36
- Tags
- 2025-07-02 colombia credential harvesting dcrat obfuscation persistence phishing remote access trojan steganography
- Related entities
- 8 observables, 21 techniques (mitre), 1 malware, 2 others
Description
A new email attack distributing DCRAT, a Remote Access Trojan, has been uncovered. The threat actor impersonates a Colombian government entity to target organizations in Colombia. The attack employs multiple evasion techniques, including password-protected archives, obfuscation, steganography, base64 encoding, and multiple file drops. DCRAT features a modular architecture, comprehensive surveillance capabilities, information theft functions, system manipulation tools, file and process management, and browser credential harvesting. The attack chain involves a phishing email with a ZIP attachment containing a bat file, which drops an obfuscated vbs file. This file eventually runs a base64-encoded script that downloads and executes the final payload. The RAT employs various persistence mechanisms and anti-analysis techniques. It attempts to bypass Windows Antimalware Scan Interface (AMSI) and continuously tries to connect to its command-and-control server.