DCRat

DCRat, also referred to as DarkCrystal RAT, is malware associated in the provided content with suspected Russian threat activity. The content describes a phishing campaign targeting the hospitality sector, particularly likely European organizations, using fake Booking.com emails with room-charge details in euros. Victims are directed to a cloned Booking.com site that displays a fake Blue Screen of Death and uses ClickFix-style social engineering to trick users into running a malicious PowerShell command. That command downloads a malicious .proj file and executes it via MSBuild.exe, a living-off-the-land technique intended to evade detection. The project file attempts to disable Windows Defender before downloading and executing DCRat. The malware is described as providing remote access, logging keystrokes, dropping additional payloads, and maintaining persistence by creating an Internet Shortcut in the Startup folder. Separate supporting content also associates DarkCrystal RAT with abuse of explorer.exe to open HTTP/HTTPS URLs via the default browser, mapped to MITRE ATT&CK T1105 Ingress Tool Transfer, to download and execute remote payloads. No additional aliases or sub-groups beyond DarkCrystal RAT/DCRat are directly supported by the content.