DecliningWindowsRemote access
Malware Intelligence

DarkCrystal RAT (DCRat)

DCRat is a cheap remote access trojan extended through plugins. Besides remote control, it carries information-stealing modules such as browser credentials, screenshots and keylogging; this is why it also appears among stealer logs.

Activity map

ZscalerMalpedia (Fraunhofer FKIE)

Activity mapLinkExtractionExecutionPackagingExfiltrationPhishing emailOfficial institution themeZIPArchiveEXEPayloadDarkCrystal RATRemote access trojanScheduled taskData collection8 targetsLog archiveC2 server
Executable payloadFile
Malicious payloadDarkCrystal RAT · Remote access trojan

DCRat is a cheap remote access trojan extended through plugins. Besides remote control, it carries information-stealing modules such as browser credentials, screenshots and keylogging; this is why it also appears among stealer logs.

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Screenshot
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Telegram
  • Discord
  • Steam
Dark Radar infection records
195,041
Latest infection record
3 February 2026
Malware type
Remote access trojan (RAT)
First seen
June 2019
01

Overview

Ranks 13 of 52 families in Dark Radar data, with 195,041 infection records.

Other names: DCRat

02

Origin and evolution

  1. June 2019Went on sale.Malpedia (Fraunhofer FKIE)
  2. 2024Used in campaigns targeting public institutions in Latin America.Zscaler
03

Technical profile

Malware typeRemote access trojan (RAT)
Target operating systemWindows
Primary purposeRemote control and data theft
Threat categoryRemote access
Programming language.NET
Distribution modelLow-cost sale on Russian-language forums
First seenJune 2019
Infected systemsWindows 10 91.5%, Windows 7 8.5%
Public source confidenceMedium
04

Targeted applications

8 applications4 categories
05

Data collection

Credentials

  • Browser passwords27%Verified
  • Session cookies28.5%Dark Radar observation
  • Refreshing expired sessions—
  • Autofill—
  • macOS Keychain—
  • 2FA and password managers—

Applications

  • Email clients—
  • FTP clients—
  • VPN clients—
  • Messaging applications99%Version-dependent
  • Gaming platforms99%Dark Radar observation

System

  • File collection10.5%Dark Radar observation
  • Screenshot64.5%Verified
  • System inventory99%Verified

Behavior

  • Additional payload downloadVerified
  • PersistenceVerified
  • Anti-analysis—
06

File system

User profile (%USERPROFILE%)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

How it works

  1. 1Infection

    • Phishing emails and malicious attachments.
    T1566.001Spearphishing Attachment

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    Dark Radar observation

    The payload ran from the Program Files folder (latest 200 logs, 23%).

    T1204.002User Execution: Malicious File

    Breaking point: Unsigned files running from user folders and injections into .NET tools are stopped by application control and EDR.

  3. 3Discovery

    Dark Radar observation

    Infected systems: Windows 10 91.5%, Windows 7 8.5%.

    T1082System Information Discovery

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    Dark Radar observation

    Data found in the latest 200 logs: password file 27%, cookies 28.5%.

    T1555.003Credentials from Web BrowsersT1113Screen CaptureT1056.001Keylogging

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    T1071.001Web ProtocolsT1105Ingress Tool TransferT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

  6. 6Persistence and aftermath

    • Remote command execution, file management and plugin loading.
    T1547.001Registry Run Keys / Startup FolderT1053.005Scheduled Task

    Breaking point: When an infection is confirmed, all sessions and access tokens on the device are revoked.

08

MITRE ATT&CK

Initial Access
Execution
Persistence
Credential Access
Collection
Discovery
Command and Control
Exfiltration
09

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
10

Risk and impact

  • Because it provides remote access, an infection is not limited to a one-time data theft; the attacker remains persistent on the device.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
11

Defense

  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
12

Learning center

How does this malware spread?
  • Phishing emails and malicious attachments.
  • The payload ran from the Program Files folder (latest 200 logs, 23%).
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which Windows artifacts should be examined?
  • Prefetch (C:\Windows\Prefetch) — shows that a short-lived payload ran.
  • Amcache.hve and ShimCache — path and hash of the executed file.
  • Downloads folder and Zone.Identifier stream — the address the file was downloaded from.
  • Browser history — the fake download page or fake CAPTCHA address.
  • RunMRU registry key — commands pasted into the Run dialog.
  • Randomly named folders and DLLs under %TEMP% and %LOCALAPPDATA%.
Which log records matter?
  • Sysmon Event 1 / Security 4688Process creation: unsigned processes starting from Temp and Downloads folders, mshta, powershell -enc chains.
  • Sysmon Olay 11 / 23File creation and deletion: self-deleting payloads, DLLs dropped under Temp.
  • Sysmon Olay 3 / 22Network connection and DNS query: to newly registered domains, C2 resolution via Telegram, Steam or Pastebin.
  • Object access auditing (4663)A process other than the browser reading Login Data, Cookies and Local State files.
  • PowerShell 4104Script block logging: obfuscated downloader commands.
  • Identity provider sign-in logsSessions after the infection from a different country and device, without a multi-factor authentication prompt.
Which MITRE techniques is it associated with?
T1566.001Spearphishing AttachmentT1204.002User Execution: Malicious FileT1547.001Registry Run Keys / Startup FolderT1053.005Scheduled TaskT1555.003Credentials from Web BrowsersT1113Screen CaptureT1056.001KeyloggingT1082System Information DiscoveryT1071.001Web ProtocolsT1105Ingress Tool TransferT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
13

Sources

Related terms

KeyloggingRemote Access TrojanThreat actor
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans