DcRAT

DcRAT, also known as DarkCrystal RAT, is a Windows remote access trojan in the AsyncRAT lineage and one of the most widely observed descendants of that ecosystem. It has been active since at least 2018 and is commonly distributed under a malware-as-a-service model, lowering the barrier to entry for criminal operators. The malware is modular and supports a broad plugin architecture that extends core remote administration with surveillance, credential and information theft, and other post-compromise functions.

DcRAT is used across both cybercrime and espionage activity. It has appeared in phishing-led intrusions, including tax-themed spearphishing operations targeting Indian taxpayers, finance personnel, and related organizations, as well as in broader malware delivery chains that also deploy other RATs and stealers. It has also been distributed through social-engineering schemes involving fake software, cheats, cracks, gaming bots, and trojanized utilities, including ClickFix-style lures and malicious archives promoted through online platforms.

On infected Windows systems, DcRAT commonly provides persistent remote access and extensive host control. Reported capabilities include victim profiling, command execution, screenshot capture, webcam and microphone access through plugins, keylogging, password and file theft, and exfiltration of collected data. Some variants and associated plugins support DLL injection and other process-injection techniques. The malware has also been observed using scheduled tasks or Windows services for persistence, and some campaigns deploy it filelessly through .NET loaders that decrypt and execute payloads directly in memory.

DcRAT places strong emphasis on defense evasion. Documented behaviors include patching Microsoft AMSI to bypass scanning, patching ETW in some variants, anti-analysis and anti-sandbox checks, and use of timing delays such as the w32tm stripchart technique. Communications are typically encrypted, with SSL/TLS-based command and control widely reported; some variants support certificate-based authentication and can be identified by characteristic self-signed certificate metadata inherited across the AsyncRAT family.

The malware is associated with a wide range of operators rather than a single threat actor. It has been linked to criminal MaaS distribution, phishing campaigns targeting Russian-speaking users, multi-family loader ecosystems, and China-aligned activity such as Operation DragonReturn, which used a multi-stage infection chain, AMSI bypass, service persistence, and covert data collection against India-focused targets. Its continued evolution, plugin ecosystem, and widespread reuse make DcRAT a durable and versatile threat in the Windows malware landscape.