Dcrat

DcRAT is a malicious software (malware) known as a Remote Access Trojan (RAT), which has been utilized in a widespread campaign to exploit computer systems. The malware infiltrates systems through deceptive methods, including downloads from fake Google Meet and OnlyFans sites. When a user interacts with these fraudulent sites, such as clicking on a Windows button, it triggers the download of a BAT file that subsequently downloads the DcRAT payload. Throughout 2023, this downloader was observed delivering various other threats, including njRAT, DarkComet, AgentTesla, and more. Notably, DcRAT and similar malware have the potential to compromise critical infrastructure systems, such as power grids and oil pipelines, posing significant security risks. The deployment of DcRAT has notably shifted towards targeting Russian-speaking users via HTML smuggling. This technique involves delivering malicious code to the user's browser under the guise of legitimate content, thereby bypassing traditional network security measures. Furthermore, the malware has been distributed in conjunction with other RATs, such as Apocalypse ClipBanker and RADXRat. A quick method to identify DcRAT is by examining the PBKDF2 salt value using appropriate tools. In December 2023, Zscaler’s ThreatLabz uncovered a campaign involving spoofed Google Meet, Zoom, and Skype websites used to facilitate the deployment of various remote access trojans. Windows systems impacted by these attacks were compromised with the NjRAT and DCRat trojans, while SpyNote RAT was distributed to targeted Android devices. These RATs can steal confidential information, log keystrokes, and potentially control infected systems. Therefore, users are urged to exercise caution when downloading files or interacting with suspicious websites.