DCRAt Attacking Users Via HTML Smuggling To Steal Login Credentials

In a new campaign that is aimed at users who speak Russian, the modular remote access tool (RAT) known as DCRat has been utilized. 

Delivered through HTML smuggling, a technique not previously seen with DCRat, the malware leverages its typical RAT capabilities to execute shell commands, log keystrokes, exfiltrate files, and steal credentials, which marks a new delivery method for DCRat, expanding its threat landscape.

HTML smuggling involves embedding obfuscated malicious payloads within HTML code, often retrieved from remote sources, which are designed to bypass security measures and execute in the victim’s browser. 

Leveraging AI for enhanced security => Free Webinar

Once rendered, the payloads are transformed into their original form and written to disk, potentially requiring user interaction, which has been exploited by various malware families, including Azorult, Pikabot, and DCRat, to deliver malicious code to unsuspecting users.

The threat actor utilized fake HTML pages mimicking TrueConf and VK Messenger to trick victims into downloading password-protected ZIP archives. 

These HTML pages, when accessed in popular browsers, automatically initiated the download and provided the decryption password “2024”, which allowed the threat actor to bypass detection by security tools unable to examine the encrypted payload. 

The malicious code within the HTML files was identified as originating from the open-source GitHub repository “TheCyb3rAlpha/BobTheSmuggler”, indicating its potential for further exploitation.

Attackers used a multi-layered archive approach to deliver DCRat.

The initial password-protected ZIP contained a disguised RarSFX archive, which then held a batch file and another password-protected RarSFX with the actual DCRat payload. 

The batch file executed the inner archive, providing the password to extract and run DCRat, whose executables were packed with tools like ENIGMA and VMProtect, and their compilation date suggests the attacker reused older DCRat builds. 

Threat actors employed a multi-layered obfuscation technique to bypass detection mechanisms by initially nested a password-protected RarSFX archive within another RarSFX archive, eliminating the need for user interaction. 

Subsequently, they wrapped the outermost RarSFX archive in a password-protected ZIP file, forcing users to provide a password.

While this added a layer of complexity, the password-protected ZIP file evaded detection on VirusTotal, demonstrating the effectiveness of such techniques in evading security measures.

The novel use of HTML smuggling to deliver DCRat malware, as researchers observed this tactic for the first time, emphasizing the ongoing need to monitor DCRat’s evolving techniques. 

To mitigate such threats, Netskope recommends organizations thoroughly inspect all HTTP and HTTPS traffic, utilizing URL filtering and threat protection policies.

Additionally, employing Remote Browser Isolation (RBI) technology can provide extra security when accessing potentially risky websites.

Free Webinar on How to Protect Small Businesses Against Advanced Cyberthreats -> Free Webinar