Executive Summary

BGD e-GOV CIRT has reviewed recent reporting on a SideCopy campaign employing spear-phishing, weaponized Windows shortcut (.LNK) files, mshta.exe, multilayer script obfuscation, .NET deserialization and reflective DLL loading to deploy a Remote Access Trojan (RAT).

The campaign begins with a weaponized ZIP archive containing an LNK file disguised as a legitimate document. Execution of the LNK retrieves an HTA payload from attacker-controlled infrastructure through mshta.exe. The HTA stage subsequently extracts additional components, establishes Registry Run Key persistence and loads the final RAT directly into the memory of mshta.exe. The observed RAT provides extensive remote-control and information-stealing capabilities, including system reconnaissance, password theft, clipboard collection, screenshots, file operations, command execution and file upload. Data is exfiltrated through an encrypted TCP connection to attacker infrastructure over port 5863.

The use of legitimate Windows components and fileless execution significantly reduces reliance on traditional malicious executable files and therefore requires behavioral, endpoint, network and email-based detection.

Key Findings

· Weaponized ZIP archives are used for initial delivery.

· LNK files are disguised as legitimate DOCX documents.

· mshta.exe is abused to retrieve and execute remote HTA content.

· HTA payloads use multiple layers of obfuscation.

· Malicious components are extracted from compressed resources.

· Registry Run Keys provide persistence.

· .NET BinaryFormatter is abused for object reconstruction.

· The final RAT is reflectively loaded into mshta.exe.

· RAT functionality includes credential, clipboard, screen and file collection.

· Encrypted C2 communication occurs over TCP port 5863.

· The campaign demonstrates a combination of living-off-the-land and fileless execution technique.