Malicious SVG Reconstructs DCRat Archive Entirely Inside Victim’s Browser

A newly analyzed DarkCrystal RAT (DCRat) campaign shows how threat actors are turning an apparently harmless SVG attachment into a full malware-delivery mechanism.

The operation, investigated by the Trellix Advanced Research Center (ARC) following a customer escalation, uses a Colombian judicial-themed lure and reconstructs a password-protected archive directly inside the victim’s browser before progressing through DLL sideloading and process hollowing.

The attachment is an SVG file, a format broadly associated with vector graphics but built on XML and capable of embedding JavaScript.

That combination gives attackers an opportunity to evade controls that more aggressively scrutinize executable, script, or macro-enabled attachments.

The page supplies the archive password, “1601,” a social-engineering detail intended to make the download look legitimate while encouraging the user to extract and execute its contents.

The technical innovation lies in the SVG’s embedded JavaScript. Trellix found that the script stores the payload as double Base64-encoded data, decodes it in the browser, and uses the Blob API to rebuild the archive in memory.

The browser then saves the resulting file as DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z in the Downloads folder.

This is an HTML-smuggling-style delivery chain: the archive does not need to be directly fetched as a conventional malicious binary from an external URL, reducing opportunities for gateway inspection and reputation-based blocking.

The extracted archive contains a decoy executable and DLL dependencies that masquerade as Brotli compression components, including libbrotlidec.dll and libbrotlienc.dll.

Brotli is a legitimate compression algorithm commonly used in web infrastructure, making those filenames useful camouflage. However, the executable’s import structure reveals a sideloading design.

When the victim launches the decoy, Windows resolves dependent DLLs from the application’s directory, allowing attacker-controlled libraries to be loaded in place of expected legitimate components.

Trellix Researchers said that, the campaign begins with a phishing email carrying an attachment framed as a legal complaint resolution, “Resolución Denuncia Jurídica.” Its purpose is simple: create urgency and exploit fear of legal consequences.

This technique is particularly effective because the executable’s imports can appear ordinary at a glance. The loader references standard Windows libraries alongside DLL names that resemble valid compression dependencies.

DarkCrystal RAT campaign

In practice, the malicious DLL chain performs staged initialization, decrypts embedded content, and prepares the next payload in memory rather than writing a plainly recognizable executable to disk.

When opened, the SVG presents a fraudulent portal styled as a Colombian judicial service. A click anywhere on the page initiates the next stage and redirects the victim to a page claiming the document is downloading.

The loader also establishes persistence by copying itself, its supporting DLLs, and a batch file into a user-controlled directory before creating a Run registry entry.

This gives the malware a path to re-execution at logon while keeping its components under the victim profile, an area often abused by commodity remote-access trojans.

The .rdata section and uses a key to perform decryption operations (XOR and SHR) across 0xBE00 bytes, storing the output in a newly allocated address space. 

The final execution sequence uses process hollowing. After decrypting data from the .rdata section through XOR- and shift-based operations, the loader reconstructs a PE image in memory, identifiable by its MZ and PE headers.

It then launches AddInProcess32.exe in a suspended state, writes malicious code into the process memory, modifies the thread context, and resumes execution.

The process retains the name of a trusted Windows component while executing attacker-supplied code.

The injected payload is a compact .NET DCRat campaign access. Its configuration is decrypted at runtime through AES-256 routines and includes host information, ports, a mutex, installation settings, encryption material, and certificate data.

The mutex string DcRatMutex_qwqdanchun provides a strong family-level attribution signal. The client also uses anti-analysis checks, delayed execution, AMSI-bypass behavior, single-instance enforcement, persistence logic, and repeated encrypted C2 connection attempts.

At the time of analysis, the command-and-control infrastructure was offline, leaving the implant in a retry loop. That does not reduce the incident’s severity: a revived C2 would restore remote-control capability to compromised hosts.

Security teams should treat SVG attachments as active content, not passive images.

Monitoring for browser-driven archive creation, DLL loads from user-writable locations, suspicious Run-key changes, and hollowed processes especially unexpected execution within AddInProcess32.exe can expose this chain before DCRat establishes operator control.

Related research has also documented judicial-themed SVG lures targeting Colombian users and using browser-based delivery followed by in-memory execution, demonstrating that this initial-access pattern remains highly reusable for RAT operators.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now