Researchers Spot DesckVB RAT Leveraging Obfuscated JavaScript and Fileless .NET Techniques

In 2026, cybersecurity researchers are tracking a highly active threat known as the DesckVB Remote Access Trojan (RAT). This malware uses a sophisticated, multi-stage infection process that begins with a simple JavaScript file and escalates to fileless .NET execution.

By operating directly in memory, DesckVB RAT effectively evades traditional security defenses while establishing persistent control over compromised systems.

The Multi-Stage Infection Chain

The attack sequence starts with a heavily obfuscated JavaScript Trojan. This initial file replicates its own code and drops an executing PowerShell script into the C:\Users\Public directory.

To ensure the compromised machine is online, the script first pings Google. Once connectivity is verified, the script decodes a Base64-encoded string in reverse to reveal a payload-hosting URL on pastee.dev.

This combination of string reversal and encoding is a deliberate evasion technique meant to bypass basic static analysis.

Following this, the malware executes a secondary PowerShell script (lkpzw_01.ps1) using an execution policy bypass.

This script attempts to communicate with a heavily obfuscated domain hosted on HostGator. To execute its next stage without triggering antivirus alarms, the malware abuses the legitimate .NET Framework utility InstallUtil.exe.

Instead of writing executable files to disk, the script reflectsively loads the .NET assembly ClassLibrary3.dll directly into system memory.

It then invokes an obfuscated method designed to establish network communication and fetch further components.

Once active, this DLL loads an additional module, ClassLibrary1.dll, which dynamically processes decrypted parameters to prepare the system for the final payload.

Evasion Tactics and Malicious Capabilities

The core of the malware’s loader mechanism relies on process injection. Using the CreateProcessA function, the malware spawns a new process in a suspended state. It injects its final payload, deceptively named Microsoft.exe.

Runtime analysis of this payload reveals a heavily encrypted configuration array that, once decoded in memory, exposes the RAT’s extensive spying capabilities.

The malware actively loads several specialized modules, including a keylogger (Keylogger.dll), an antivirus detector (DetectAV), and tools for unauthorized webcam access.

According to Pointwild research, network analysis shows that the DesckVB RAT hides its command-and-control (C2) communications by using standard TLS-encrypted traffic over port 443, allowing it to blend in with legitimate HTTPS traffic.

The malware establishes secure channels to exfiltrate data and receive instructions. Packet captures reveal the malware transmitting internal module statuses such as ping checks and AV detection alerts directly to its C2 server.

A secondary C2 configuration was also observed connecting to a dynamic DNS domain, manikandan83.mysynology.net, operating over port 7535.

Indicators of Compromise (IOCs)

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.