Back 
概要
DCRat (also known as Dark Crystal RAT) is a modular remote access Trojan (RAT) which is offered as malware-as-a-service (MaaS) and has been around since 2018. It is written in C# and has typical RAT and information stealing capabilities, such as executing shell commands, logging keystrokes, exfiltrating files and credentials, among others.
DCRat has historically been delivered through compromised or fake websites, password-protected archives delivered through popular media such as Signal, Cobalt Strike Beacons, or email spam with macro-embedded Excel or PDF attachments.
During threat hunting activities, the Netskope team discovered Russian-speaking users being targeted with DCRat that was delivered through HTML smuggling, a delivery technique we haven’t previously observed to deploy DCRat. In this blog we will further analyze the techniques used in this campaign.
HTML smuggling
HTML smuggling is primarily a payload delivery mechanism. The payload can be embedded within the HTML itself or retrieved from a remote resource. It is typically obfuscated with a combination of compression, encoding, or encryption. This enables it to more easily bypass network security mechanisms and reach the victim’s browser.
Once the HTML begins rendering in the browser, the malicious payload is transformed into its original form. There may be anti-emulation measures implemented in the HTML such that, for example, the payload is transformed only if the mouse pointer moves. The transformed payload is then automatically written to disk, or it may require user interaction in the form of mouse clicks. The threat actor usually employs some form of social engineering to persuade the user to execute the payload.
Among others, this technique has been leveraged by Azorult, Pikabot, and now DCRat.
HTML file analysis
The threat actor leveraged fake HTML pages that impersonated TrueConf and VK Messenger media applications in the Russian language. We do not currently know how these HTML pages were delivered to the victim.
At the time of writing this blog, one of the HTML files was not detected by any engine on VirusTotal while the other had 10 detections.
The HTML files, when opened in any browser including Chrome, Firefox and Edge, automatically downloaded a password-protected ZIP archive to disk. The HTML page also provided the victim with the password to decrypt the ZIP payload. In both cases, the password was “2024”. This is a classic example of evading detection since security tools do not have access to the password, thus preventing them from examining the real payload within the encrypted ZIP archive.
The smuggling-related code in the two HTML files had been derived from the open-source GitHub repository, TheCyb3rAlpha/BobTheSmuggler. This was evident from the structure of the JavaScript code.