Trellix details a DCRat campaign that hides a malware archive in an SVG file using HTML smuggling and process hollowing.
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
DCRat Campaign Uses SVG HTML Smuggling to Deliver DarkCrystal RAT
At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a malware-as-a-service tool Target Users lured with a Colombian judicial theme Delivery vector Phishing email with a malicious SVG attachment Key capabilities Remote access, DLL sideloading, process hollowing, encrypted C2 Source Trellix Advanced Research Center (ARC) TL;DR Trellix analysts uncovered an active DCRat campaign that starts with a booby-trapped SVG file.
securityonline.info
August 18, 2026 at 1:02 AM
Trellix details a DCRat campaign that hides a malware archive in an SVG file using HTML smuggling and process hollowing.
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
#DCRat #DarkCrystalRAT #HTMLSmuggling #ProcessHollowing #Malware #Phishing
In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01/27/p...
Process Hollowing on Windows 11 24H2
Process Hollowing (a.k.a. RunPE) is probably the oldest, and the most popular process impersonation technique (it allows to run a malicious executable under the cover of a benign process). It is us…
hshrzd.wordpress.com
January 26, 2025 at 11:55 PM
In case if you wonder what broke #ProcessHollowing on Windows 11 24H2, I have something for you: hshrzd.wordpress.com/2025/01/27/p...
Abusing Windows Internals - I have just completed this room! Check it out: tryhackme.com/room/abusing... #tryhackme #Windows #Evasion #ProcessInjection #RedTeam #PortableExecutable #DLLInjection #PEInjection #ProcessHollowing #abusingwindowsinternals via
@realtryhackme
@realtryhackme
TryHackMe | Cyber Security Training
An online platform for learning and teaching cyber security, all through your browser.
tryhackme.com
February 26, 2024 at 7:38 PM
Abusing Windows Internals - I have just completed this room! Check it out: tryhackme.com/room/abusing... #tryhackme #Windows #Evasion #ProcessInjection #RedTeam #PortableExecutable #DLLInjection #PEInjection #ProcessHollowing #abusingwindowsinternals via
@realtryhackme
@realtryhackme
Advanced Static Analysis - I have just completed this room! Check it out: tryhackme.com/room/advance... #tryhackme #staticanalysis #disassembly #ghidra #malwareanalysis #processhollowing #advancedstaticanalysis via @realtryhackme
TryHackMe | Cyber Security Training
An online platform for learning and teaching cyber security, all through your browser.
tryhackme.com
October 17, 2023 at 10:32 AM
Advanced Static Analysis - I have just completed this room! Check it out: tryhackme.com/room/advance... #tryhackme #staticanalysis #disassembly #ghidra #malwareanalysis #processhollowing #advancedstaticanalysis via @realtryhackme