Malicious SVG Files Used to Deliver DCRat Through Browser-Based Attack Chain
A newly analyzed campaign is using seemingly harmless SVG attachments to deliver DarkCrystal RAT (DCRat) through a multi-stage infection process.
Researchers from the Trellix Advanced Research Center investigated the campaign after a customer report and found attackers using a Colombian judicial-themed phishing lure. The attack reconstructs a password-protected archive inside the victim's browser before using DLL sideloading, persistence, and process hollowing to deploy the RAT.
SVG Attachment Hides the Initial Payload
SVG files are normally associated with vector graphics, but because they are XML-based and can contain JavaScript, attackers can turn them into active delivery mechanisms.
Browser Reconstructs the Malicious Archive
The embedded JavaScript stores the payload as double Base64-encoded data. When executed, the browser decodes the content and uses the Blob API to reconstruct the archive in memory.
The resulting file is saved to the Downloads folder as:
DOC-16-ENE-2026 RESOLUCION DENUNCIA JURIDICA.7z
The archive password, 1601, is displayed by the malicious page, encouraging the victim to extract and execute the contents.
This technique resembles HTML smuggling, where malicious content is assembled locally rather than downloaded directly as a conventional executable.
Colombian Legal Lure Creates Urgency
The campaign begins with a phishing email presenting the attachment as a legal complaint resolution named “Resolución Denuncia Jurídica.”
Fake Judicial Portal Drives the Infection
Opening the SVG displays a fraudulent Colombian judicial-service portal. Clicking the page initiates the next stage and redirects the victim to a screen claiming that the document is being downloaded.
The legal theme is designed to create urgency and encourage users to open the attached archive without closely examining its contents.
DLL Sideloading Conceals the Loader
The extracted archive contains a decoy executable alongside DLL files designed to resemble legitimate Brotli compression components, including libbrotlidec.dll and libbrotlienc.dll.
Legitimate-Looking DLL Names Provide Cover
When the victim launches the decoy executable, Windows searches the application directory for required dependencies. The malicious libraries can therefore be loaded instead of legitimate components.
The DLL chain decrypts embedded content and prepares subsequent payloads in memory, making the infection less dependent on clearly identifiable executable files being written to disk.
Persistence and Memory Injection Complete the Chain
The malware also establishes persistence by copying its components and a batch file into a user-controlled directory before creating a Run registry entry.
Process Hollowing Hides DCRat
The loader decrypts data from its .rdata section using XOR and shift-based operations and reconstructs a PE image in memory.
It then starts AddInProcess32.exe in a suspended state, replaces content within the process memory, modifies the execution context, and resumes the process.
The trusted Windows process name can consequently conceal execution of attacker-controlled code.
DCRat Payload Activates After Injection
The final payload is a compact .NET-based DCRat implant.
RAT Uses Encryption and Anti-Analysis Features
Its configuration is decrypted at runtime using AES-256 and contains information including host details, ports, mutex data, installation settings, encryption material, and certificate information.
The mutex DcRatMutex_qwqdanchun provides a useful family-level indicator.
The malware also implements anti-analysis checks, delayed execution, AMSI-bypass behavior, single-instance enforcement, persistence mechanisms, and repeated encrypted command-and-control attempts.
At the time of Trellix's analysis, the C2 infrastructure was offline, leaving the malware repeatedly attempting to establish communication.
Security Teams Should Treat SVGs as Active Content
The campaign demonstrates how attackers can turn a file commonly perceived as harmless into a complete malware-delivery mechanism.
Key Detection Opportunities
Defenders should monitor for:
- Browser-generated archive files
- DLL loading from user-writable directories
- Unexpected Run-key modifications
- Suspicious execution of trusted Windows processes
- Process-hollowing behavior
- Unusual SVG attachments arriving through email
- Unexpected encrypted outbound connections
Security teams should also inspect suspicious SVG files in controlled environments rather than opening them directly on analyst workstations.
A Growing Threat From Active File Formats
The campaign highlights a broader shift toward abusing document and image-related formats as malware delivery mechanisms.
Browser-Based Delivery Reduces Traditional Detection Opportunities
By reconstructing the archive inside the browser and following it with DLL sideloading and process hollowing, attackers can move through multiple stages before the final RAT becomes visible.
Organizations should therefore combine email security with browser monitoring, endpoint telemetry, application-control policies, and behavioral detection to identify suspicious activity that traditional file-based defenses may miss.