DCRat (Dark Crystal RAT, DarkCrystal RAT) is a .NET-based
remote access trojan plus info-stealer that has been sold as
malware-as-a-service since at least 2019. Public trackers list
the family under the canonical literal DCRat. CERT-UA has
flagged DCRat campaigns against Ukrainian defense and
government targets, attributed to Russia-aligned operators
(Sandworm plus other clusters).
The harvested log opens with a five-line Figlet small- font
ASCII-art banner spelling Dark Crystal RAT, then a
horizontal-rule line of em-dashes, then four flat Key: Value
blocks separated by blank lines. The first block carries WMI
hardware enumeration including PC Name, User Name,
Windows version, CPU Name, CPU Cores (with parenthesised
logical-thread count), GPU Name, GPU Mode (WxH x
color-depth triple), Motherboard (Win32_BaseBoard SMBIOS
string), BIOS (Win32_BIOS string), Antivirus, Firewall,
RAM (locale-aware comma decimal), and LANIP. The second
block reports the .NET Framework version and the install path
(DCRat typically masquerades as a fake system service binary,
for example fontdrvhost.exe under a typo-squatted
MsHyperserverBrokersvc folder). The third block is
geolocation (IP, City, Country as CC / Name,
Location as latitude / longitude). The tail reports the
monitor list and Save Time in DD.MM.YYYY HH:MM European
format.
