eSentire’s TRU team found that DcRAT was distributed via explicit lures on OnlyFans pages, delivering a VBScript loader payload. The loader decodes and injects DcRAT into RegAsm, enabling remote access, keylogging, credential theft, and ransomware capabilities. Hashtags: #DcRAT #OnlyFans #VBScript #Regsvr32
Keypoints
- DcRAT was identified in May 2023 at a consumer services customer and distributed using explicit lures tied to OnlyFans/adult content.
- The lure delivers a ZIP containing a VBScript loader that is executed manually by the user.
- The VBScript loader embeds and decodes the payload (dynwrapx.dll) and registers it with Regsvr32 to gain access to DynamicWrapperX.
- The loader uses CallWindowProcW and VirtualAlloc to execute shellcode and inject the payload into RegAsm.exe.
- The observed DcRAT payload includes keylogging, remote access, browser credential and cookie stealing, and a ransomware plugin that encrypts non-system files.
- Indicators include MD5s and an C2 IP, with public samples dating back to January 2023 and activity through June 2023.
MITRE Techniques
- [T1566.001] Phishing – Lure-based distribution via OnlyFans content; “In observed instances, victims were lured into downloading Zip files containing a VBScript loader which is executed manually.”
- [T1059.005] VBScript – The VBScript loader is used to decode and load the payload; “The loader (MD5 43876a44cc7736ff6432cb5d14c844fe) is a slightly modified version of this VBScript file analyzed by Splunk in 2021.”
- [T1218.011] Regsvr32 – The loader extracts embedded dynwrapx.dll and registers it using Regsvr32 to gain access to DynamicWrapperX; “registers it using Regsvr32 to gain access to DynamicWrapperX.”
- [T1055] Process Injection – The payload is loaded into memory and injected into RegAsm.exe; “loads the payload (BinaryData) into memory then calls CallWindowProcW to execute the shellcode, ultimately injecting the payload into Microsoft.NETFrameworkv4.0.30319RegAsm.exe.”
- [T1082] System Information Discovery – The loader checks the OS architecture using WMI; “Checks the OS (Operating Systems) architecture using WMI.”
- [T1056.001] Keylogging – DcRAT includes keylogging as part of its capabilities; “Beyond baseline capabilities such as keylogging, remote access, webcam monitoring, and file manipulation…”
- [T1555.003] Credentials in Browser – DcRAT includes browser credential and cookie stealing; “a browser credential and cookie stealer, a Discord token stealer and ransomware plugin…”
- [T1486] Data Encrypted for Impact – The ransomware plugin encrypts non-system files and appends “.DcRat” to filenames; “The ransomware plugin encrypts non-system files and appends “.DcRat” to the filename.”
Indicators of Compromise
- [File Hash] context – 43876a44cc7736ff6432cb5d14c844fe
- [File Hash] context – 9ea7ad97f219592366510d75fc945ea2
- [File Hash] context – 87fb8606f8fc38278112d5de9479f85c
- [IP Address] context – 141.95.84[.]40