Inside DesckVB Rat Analysis: From Malspam to In-Memory RAT

DesckVB RAT emerged in February 2026 through a sophisticated malspam campaign utilizing a dynamic delivery kit that personalizes lures on-the-fly by extracting victim email addresses and pulling company logos in real-time. The attack chain routes through Google's DoubleClick domain to evade email gateways before delivering a five-stage infection: HTML redirect, JScript loader, PowerShell dropper, .NET loader, and finally the RAT itself. The malware employs extensive anti-analysis techniques including sandbox detection, forced reboots upon detection, and in-memory execution via .NET reflection. Once established, it patches AMSI and ETW at the native API level, injects into legitimate Microsoft-signed binaries like InstallUtil.exe and MSBuild.exe, and establishes persistence through registry keys and scheduled tasks. The RAT communicates with DDNS-based C2 infrastructure on non-standard ports, performs system reconnaissance including GPU enumeration possibly for crypto mining, and can deliver additional payl...

• Command & Evade: Turla's Kazuar v3 LoaderMalware2026-01-15
• From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainCampaign2026-09-21
• Analysis of a Modular Cyber Espionage FrameworkMalware2026-08-07
• A Deep Dive Into the Latest XCSSET VersionMalware2026-08-03
• Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File InflationMalware2026-07-07