IBM X-Force Threat Analysis: DCRat presence growing in Latin America

In early May 2025, IBM X-Force observed Hive0131 conducting email campaigns targeting users in Colombia with electronic notifications of criminal proceedings, purporting to be from The Judiciary of Colombia. Hive0131 is a financially motivated group likely originating from South America that routinely conducts campaigns largely in Latin America (LATAM) to deliver a wide array of commodity payloads. The current campaigns imitate official correspondence and contain either an embedded link or a PDF lure with an embedded link. Clicking on the embedded link will initiate the infection chain to execute the banking trojan "DCRat" in memory. 

DCRat is operated as a Malware-as-a-Service (MaaS), first appearing in at least 2018, and heavily advertised on Russian cyber crime forums, purchasable for around USD 7 for a two-month subscription. DCRat's presence is widespread and has become increasingly popular in LATAM since at least 2024. Over the summer of 2024, X-Force observed several campaigns heavily targeting entities in Colombia, all imitating a LATAM company specializing in electronic document ecosystems in Mexico and Colombia. However, given the differences in infection chain and the delivery of DCRat, X-Force assesses that the 2024 and current campaigns were conducted by different actors. The campaigns observed in 2024 relied heavily on password-protected RAR files containing NSIS to execute a GuLoader downloader, whereas these recent campaigns rely on an obfuscated .NET loader we've named VMDetectLoader. 

• Bypasses AMSI
• Detects analysis environments
• Kills blocklisted processes
• Obtains persistence through a scheduled task or registry key
• Listens for commands from a command and control (C2) server

DCRat comes with plugins that are capable of the following tasks, although threat actors can create custom plugins in order to accomplish additional tasks:

• Recording a victim through the computer's microphone or camera
• Uploading and downloading files
• Executing commands
• Obtaining system information
• Encrypting and decrypting files
• Editing registry keys
• Logging keystrokes and clipboard data
• Manipulating the filesystem

MaaS

In early May 2025, X-Force observed Hive0131 email campaigns imitating The Judiciary of Colombia (Rama Judicial de Colombia), purporting to be from the Civil Circuit of Bogota, Colombia, to send out electronic notifications of criminal proceedings. The observed campaigns either contain a PDF lure with a link to a TinyURL or contain an embedded link to a Google Docs location. 

Infection Chain Overview - PDF with TinyURL

For the emails containing a PDF lure leading to a tinyurl, the victim is redirected to a ZIP archive named 1Juzgado 08 Civil Circuito de Bogotá Notificacion electronica Orden de Embargo.Uue. The ZIP archive contains benign files as well as a malicious JavaScript file named 1Juzgado 08 Civil Circuito de Bogotá Notificacion electronica Orden de Embargo.js. The JavaScript file downloads a JavaScript payload from a paste[.]ee site and executes it. This payload then executes a PowerShell command that downloads a JPG from hxxps://archive[.]org/download/new_ABBAS/new_ABBAS.jpg with a base64-encoded loader appended to the end of the file. Once executed, the loader downloads and executes DCRat in memory.

The loader is given the name VMDetectLoader due to its ability to determine if it's running in a sandbox environment. Analysis indicates that the loader is based on the open-source project https://github.com/robsonfelix/VMDetector.

Infection chain overview - Embedded Google Docs link

This infection chain is initiated with phishing emails that contain a link to a Google Docs download of a password-protected ZIP archive named CUI 158616000129-2025-10047_122011111777.zip, the password of which is in the email and is 3004. The archive contains a batch file downloader, CUI 158616000129-2025-10047_122011111777.bat, that downloads and executes an obfuscated VBScript (VBS) component fromhxxp://paste[.]ee/d/jYHEqBJ3/0  to %WinDir%\Temp\Pernambuco.vbs. The VBS script subsequently decodes and executes a base64-encoded PowerShell script that downloads VMDetectLoader via a JPG file fromhxxps://ia601205.us.archive[.]org/26/items/new_image_20250430/new_image[.]jpg . 
The final payload is then downloaded by VMDetectLoader via a paste[.]ee URL passed to it by the PowerShell script.

VMDetectLoader is an obfuscated .NET loader (Microsoft.Win32.TaskScheduler.dll) which can be found on VirusTotal at https://www.virustotal.com/gui/file/0df13fd42fb4a4374981474ea87895a3830eddcc7f3bd494e76acd604c4004f7. Analysis of the loader's metadata indicates that the code is based on the open-source project https://github.com/robsonfelix/VMDetector.

Assembly Attributes:

Before loading the payload, the loader detects virtual machines, printing a list of host attributes to the console if a VM is detected. For example:

Functionality

VMDetectLoader is executed via its dnlib.IO.Home.VAI()  function and passed data similar to the following. This information may vary depending on the campaign.

During execution, VMDetectLoader, XOR decrypts notable strings as needed from the .NET resource "hIXS".

Sample decrypted strings

Persistence

If configured to do so, a scheduled task is created to execute the following PowerShell command which downloads and executes a JavaScript payload:

Another task may be created, if configured, to execute the JavaScript payload using the following command:

The loader may also create a Registry run key to execute the payload:

Process injection

VMDetectLoader has the ability to use the process hollowing injection technique to load a payload into varying target process instances. For example, for the analyzed campaign, C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe (32-bit) or C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe (64-bit) is the target process. The function responsible for process injection is named HackForums.gigajew.x64.Load() for 64-bit samples and dnlib.IO.Tools.Ande() for 32-bit samples.

Process hollowing injection process:

1. Create a suspended process using CreateProcess() with the dwCreationFlags set to CREATE_SUSPENDED (4).
2. Unmap memory in the target process using ZwUnmapViewOfSection().
3. Allocate new memory in the target process using VirtualAllocEx().
4. Write the payload to the newly allocated memory using WriteProcessMemory().
5. Update the entry point for the process using GetThreadContext() and SetThreadContex().
6. Execute ResumeThread() to execute the code.

If VMDetectLoader determines that it's running in a safe environment, the final payload is loaded via process hollowing. In this instance, the final payload is DCRat with the following configuration data.

X-Force tracks several groups operating in the Latin American threat landscape that conduct email campaigns delivering MaaS for the purpose of financial gain. Among the tracked groups are Hive0148 and Hive0149, which focus on delivering the Grandoriero Banking Trojan, Hive0153 delivering Adwind and SambaSpy malware, and Hive0131. Although Hive0131 typically focuses on operations with the delivery of malware such as QuasarRAT and NjRAT, X-Force has observed an increase in campaigns involving DCRat. With the steady and ongoing observances of banking malware delivered to users within LATAM, IBM X-Force assesses that Latin America will continue to face targeting from threat actors seeking to deploy banking trojans via phishing campaigns in attempts to obtain user credentials and other sensitive information.

Entities in LATAM are encouraged to exercise caution with emails containing attachments, links, or that prompt file downloads. In addition, entities are advised to perform the following:

• Exercise caution with emails containing links or download prompts
• Monitor for host-based evidence of process injection, rogue process creation, scheduled tasks creation, and registry modifications
• Install, update and configure endpoint security software
• Monitor endpoint rules
• Hunt for the execution policy bypass

IBM X-Force Premier Threat Intelligence is now integrated with OpenCTI, delivering actionable threat intelligence about this threat activity and more. Access insights on threat actors, malware and industry risks. Install the OpenCTI Connector to enhance detection and response, strengthening your cybersecurity with IBM X-Force’s expertise. Stay ahead—integrate today.