DCRAT — Malware Profile

DCRAT is a variant of the open-source AsyncRAT developed in C# with additional capabilities such as patching Microsoft’s Antimalware Scan Interface (AMSI).

MITRE ATT&CK techniques (4)

• T1027.013 Encrypted/Encoded File
• T1056.001 Keylogging
• T1573.002 Asymmetric Cryptography
• T1685 Disable or Modify Tools

IntelFusions coverage

• Sandworm (APT44) Deploys Trojanized KMS Activators Against Ukrainian Users: BACKORDER Go Loader, DcRAT Espionage, and Kalambur TOR-Based RDP Backdoor 2026-02-16
• Fake GTA 6 installer steals your data, then wipes the disk 2026-09-12

Attributed threat actors

• APT-C-36

Read the full analysis on IntelFusions