Vibecoded RAT? A LOLBins chain hiding behind an HTA file

Two files, Notificacion Fiscal.js and radicado.hta, arrived via a phishing campaign impersonating Colombian authorities. Neither did much on its own. The interesting part was the attack chain that connected them, and how it relied solely on binaries Windows ships by default: so-called Living off the Land Binaries (LOLBins).

The Lure

The JavaScript file carried no malicious logic beyond obfuscation. Its only job was to launch the HTML Application (.hta) file sitting in the same directory. Inside that .hta file, the attacker hid VBScript that runs automatically the moment the file opens.

Execution Chain

Three legitimate Windows binaries ran in the following order:

• wscript.exe (Notificacion Fiscal.js) spawns the dropper.
• mshta.exe (radicado.hta) launches the RAT via
• powershell.exe (amaU4Czu9.ps1).

No suspicious binaries, just legitimate Windows Binaries

Every stage of this chain runs through a legitimate Windows binary that ships with the operating system. There is no suspicious executable to flag, no unsigned payload being dropped onto disk. The attacker is simply using tools that are already there for purposes they were never intended for.

In this case, the detection didn’t come from the process behavior. It came from a threat intelligence hit on the C2 domain. That’s the problem with Living off the Land techniques: when attackers use trusted Windows binaries to carry out malicious actions, file-based controls can have very little to go on. Detecting the attack means looking at what those processes are actually doing, and having an analyst who can recognize when legitimate activity doesn’t make sense.

The Trojan’s Capabilities

• Arbitrary command execution via Invoke-Expression.
• Real-time active window capture, using GetForegroundWindow via P/Invoke.
• Download-and-execute from an external URL or directly from C2.
• Drop and execute base64-encoded payloads (.ps1, .bat, .vbs, .msi, .hta, .dll).
• Anti-sandbox checks: RAM and CPU fingerprinting paired with extended sleep timers.
• Remote, clean uninstall.

Command and Control (C2)

The implant POSTs every 2 seconds, an unusually aggressive beacon interval for a RAT. The victim’s fingerprint (hostname, username, antivirus product, UAC status, disk serial) travels in the User-Agent header rather than the request body, which keeps it out of the part of the traffic a quick log review actually reads.

• C2 domain: envioansyr.dynuddns[.]net
• C2 IP: 45.83.31[.]50
• C2 port: 7171

Persistence

• A scheduled task, JXgiUraaW, running every 30 minutes.
• An HKCU\...\CurrentVersion\Run registry key named aRkmqyRPo, pointing at the RAT script amaU4Czu9.ps1.
• A VBS file, SHEiCWnddP.vbs, dropped into the Startup folder (Start Menu\Programs\Startup\).

Three independent persistence mechanisms for one implant: removing only one or two leaves the attacker a way back in.

MITRE ATT&CK

Techniques observed in this case.

Tactic	Technique	ID
Initial Access	Phishing: Spearphishing Attachment	T1566.001
Execution	User Execution: Malicious File	T1204.002
Execution	Command and Scripting Interpreter: JavaScript	T1059.007
Execution	Command and Scripting Interpreter: Visual Basic	T1059.005
Execution	Command and Scripting Interpreter: PowerShell	T1059.001
Defense Evasion	System Binary Proxy Execution: Mshta	T1218.005
Persistence	Scheduled Task/Job: Scheduled Task	T1053.005
Persistence	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	T1547.001
Defense Evasion	Virtualization/Sandbox Evasion: System Checks	T1497.001
Defense Evasion	Virtualization/Sandbox Evasion: Time Based Evasion	T1497.003
Discovery	Application Window Discovery	T1010
Discovery	Security Software Discovery	T1518.001
Discovery	System Information Discovery	T1082
Command and Control	Application Layer Protocol: Web Protocols	T1071.001
Command and Control	Ingress Tool Transfer	T1105

Indicators of Compromise

C2 domain               envioansyr.dynuddns[.]net (port 7171)
C2 IP                   45.83.31[.]50
Notificacion Fiscal.js  D65EA680B967566E29B268106D9009BF0624C63597FC0C07768FD63753530144
radicado.hta            A0338FAB97DEF632B77C49DD11D9A0A2C244CEDF1596162C2F59890C42796E18
amaU4Czu9.ps1           1DCB0E378E64668BB4A82B7A43512893F7EBA67DA9B64B031D6CE91A60573D41
Scheduled task          JXgiUraaW (runs every 30 minutes)
Run key                 aRkmqyRPo (pointing to amaU4Czu9.ps1)
Startup VBS             SHEiCWnddP.vbs (pointing to amaU4Czu9.ps1)

Note: the hash for amaU4Czu9.ps1 was computed from a reconstruction of the script as extracted from radicado.hta. The file itself wasn’t recovered directly from the victim’s machine, so the actual hash may differ depending on encoding and line endings.

Detection Notes

• A “clean” process tree doesn’t mean a clean host. Every binary in this chain (wscript.exe, mshta.exe, powershell.exe) ships with Windows and is trusted by default. How they interact with each other, is the signal.
• Read headers, not just bodies. The victim’s fingerprint travels in the User-Agent header rather than the request body, an unusual choice that could easily be missed during a quick review of the traffic.
• Redundant persistence is deliberate. A scheduled task, a Run key, and a Startup-folder script for one implant means pulling any single one still leaves the operator two ways back in.

The Takeaway

This attack didn’t rely on anything particularly exotic. It relied on legitimate Windows tools being used for illegitimate purposes, and on those actions looking ordinary when viewed one process at a time.

That’s why catching this kind of activity requires more than asking whether a file is malicious. You need to see the behavior around it, understand the context, and know when something legitimate doesn’t make sense.

That’s where experienced detection and investigation make the difference.