Vibecoded RAT? A LOLBins chain hiding behind an HTA file

Two files, Notificacion Fiscal.js and radicado.hta, arrived via a phishing campaign impersonating Colombian authorities. Neither one did much on its own. The payoff was in the chain, and in how thoroughly it stayed inside binaries Windows ships by default.

The lure

The JavaScript file carried no malicious logic beyond obfuscation. Its only job was to launch the HTML Application (.hta) file sitting in the same directory. Inside that .hta file, the attacker hid VBScript that runs automatically the moment the file opens.

Execution chain

Three legitimate Windows binaries, one after another:

• wscript.exe (Notificacion Fiscal.js) spawns the dropper.
• mshta.exe (radicado.hta) launches the RAT via
• powershell.exe (amaU4Czu9.ps1).

The standout detail: no malware, just LOLBins

Every stage of this chain runs through a binary that ships with Windows by default. Nothing here would look abnormal to a control watching for unsigned or unusual executables. The detection didn’t come from process behavior at all. It came from a threat intelligence alert on the C2 domain. Living-off-the-land execution chains like this one are built specifically to stay quiet in front of that kind of control, and they largely succeed.

RAT capabilities

• Arbitrary command execution via Invoke-Expression.
• Real-time active window capture, using GetForegroundWindow via P/Invoke.
• Download-and-execute from an external URL or directly from C2.
• Drop and execute base64-encoded payloads (.ps1, .bat, .vbs, .msi, .hta, .dll).
• Anti-sandbox checks: RAM and CPU fingerprinting paired with extended sleep timers.
• Remote, clean uninstall.

Command and control

The implant POSTs every 2 seconds, an aggressive beacon interval for a RAT trying to stay under the radar. The victim’s fingerprint (hostname, username, antivirus product, UAC status, disk serial) travels in the User-Agent header, not the request body, which keeps it out of the payloads most casual log review actually reads.

• C2 domain: envioansyr.dynuddns[.]net
• C2 IP: 45.83.31[.]50
• C2 port: 7171

Persistence

• A scheduled task, JXgiUraaW, running every 30 minutes.
• An HKCU\...\CurrentVersion\Run entry, aRkmqyRPo, pointing at the RAT script amaU4Czu9.ps1.
• A VBS file, SHEiCWnddP.vbs, dropped into the Startup folder (Start Menu\Programs\Startup\).

Three independent persistence mechanisms for one implant: removing only one or two leaves the operator a way back in.

Indicators of compromise

C2 domain               envioansyr.dynuddns[.]net (port 7171)
C2 IP                   45.83.31[.]50
Notificacion Fiscal.js  D65EA680B967566E29B268106D9009BF0624C63597FC0C07768FD63753530144
radicado.hta            A0338FAB97DEF632B77C49DD11D9A0A2C244CEDF1596162C2F59890C42796E18
amaU4Czu9.ps1           1DCB0E378E64668BB4A82B7A43512893F7EBA67DA9B64B031D6CE91A60573D41
Scheduled task          JXgiUraaW (every 30 minutes)
Run key                 aRkmqyRPo -> amaU4Czu9.ps1
Startup VBS             SHEiCWnddP.vbs

Note: the hash for amaU4Czu9.ps1 was computed from a reconstruction of the script as extracted from radicado.hta. The file itself wasn’t recovered directly from the victim’s machine, so the actual hash may differ depending on encoding and line endings.

Takeaways for defenders

• A clean process tree doesn’t mean a clean host. Every binary in this chain (wscript.exe, mshta.exe, powershell.exe) ships with Windows and is trusted by default. The chain of custody between them, not any single process, is the signal.
• Check header fields, not just bodies. This C2 hid its victim fingerprint in the User-Agent string specifically because most casual triage reads request bodies and skims headers.
• Redundant persistence is a pattern, not an accident. A scheduled task, a Run key, and a Startup-folder script for the same implant means removing one silently leaves two more.