Executive summary

This research documents a recent phishing wave themed around judicial and administrative matters, reconstructed from 12 initial fraudulent emails, multiple ZIP archives, JavaScript files, VBS and the final RAT. Collection, controlled detonation and technical analysis took place in separate virtual machines over approximately seven days.

Key findings

The campaign uses Portuguese and Spanish lures that resemble court notifications, fiscalía notices, tutela proceedings and administrative documents. The attachments lead to pages that simulate institutional services or protected files, followed by an HTML and JavaScript flow with obfuscation and decoding.

The visible code collects host information, queries the Windows Registry, checks directories and prepares a decryption routine. The data sought includes system version, network profile, installation date, memory size, computer name, environment variables and directories localized in Portuguese and Spanish.

The observed infrastructure has two roles. crp2026[.]online serves as protected distribution behind Cloudflare, with the origin concealed behind 104[.]21[.]16[.]229 and 172[.]67[.]216[.]190. vpfinal142[.]myvnc[.]com points to a dedicated C&C associated with 45[.]146[.]81[.]142, where the reported exposure includes ports 4782, 5357 and 5985. Separating distribution from C&C reduces the value of an isolated IP block.

The binary screens indicate a PE64 compiled in VB.NET and compatible with .NET Framework 4.8, with obfuscation and virtualization. The configuration exposes fields for hosts, ports, version, key, mutex and certificate, but their values are redacted in the public version.

There is high confidence that the campaign represents a recent operation built with dedicated infrastructure, supported by the complete chain observed in the laboratory, infrastructure queries and artifact correlation. The Brazilian-operator hypothesis has strong geographic and linguistic convergence, including hosting in Cotia, a Brazilian ASN, America/Sao_Paulo timezone, Portuguese code and Portuguese lures. The association with APT-C-36 and the AsyncRAT/DCRat lineage results from analysis of the complete corpus, including progression through multiple stages to the final RAT.

Scope and method

The corpus contains 12 initial fraudulent emails, multiple ZIP archives, JavaScript and VBS files, judicial query pages, email headers, web responses in Base64, code excerpts, dnSpy screens, PE64 analysis and the final RAT. The chain was followed for approximately seven days, from the lures and compressed files through the final payload configuration and behavior. The twenty figures are used inline where they explain the corresponding finding. The public copy is sanitized, while the primary artifacts remain in the segregated laboratory.

Analysis method

The messages were treated as evidence of social engineering, not as proof of institutional authenticity. Subject, theme, attachment type, use of a password, observed recipients and available headers were compared. Figures 1 and 5 show the lures; figures 3, 4 and 6 show the presence of attachments and the handling of a JavaScript file; figures 7 and 13 preserve the header structure after identifiers were redacted.

The JavaScript excerpts were grouped by visible function: WScript object creation, environment collection, Registry reads, directory enumeration, simple hashing, path checks and decoding. Static analysis was complemented by controlled execution in separate VMs. The text uses “implemented” for behavior identified in code and “observed” when controlled execution confirmed it.

The samples were analyzed in separate VMs using triage, static analysis, decompilation and controlled observation tools. dnSpy and PE analyzer screens document format, language, framework, classes and configuration fields; the original files were also used to follow the email, ZIP, JavaScript, VBS and final RAT progression. The AsyncRAT forked from DCRat classification results from code, configuration and observed behavior comparison. Host, port, key, mutex and certificate values are not reproduced in the public version.

Infection chain

The chain begins with plausible messages aimed at people who handle cases, contracts or institutional service requests. The lure does not depend on an exploit visible in the captures. It uses urgency, apparent authority, a protected document and a query page to shift the recipient’s security decision.

Consolidated infection chain

1. Initial access: the victim receives an email with 43262 CONSTANCIA-Despacho.COL.97-126.xhtml, approximately 4.2 MB, using a Colombian judicial theme.
2. Browser execution: the victim opens the attachment. The file is an SVG disguised as XHTML and renders the fake Consultas, Fiscalía General de la Nación page.
3. HTML smuggling: the page generates the ZIP inside the browser using ZipCrypto and a password displayed on the page. The filename follows Demanda_Ejecutiva_*__EXP2026-XXXX.zip; the email gateway never inspects the locally generated ZIP.
4. Dropper execution: the victim opens the ZIP and executes the JavaScript dropper presented as Network Configuration Auditor v2.7.298, approximately 4.2 MB, with noise markers in the form /*2ab3[…]*/.
5. Stage chaining: the dropper decodes and chains stages 3, 4 and 5. The hash identifiers begin with efa891[…], 43bf[…] and 3bfb[…]. During the transition, the script deletes the original XHTML and removes Mark-of-the-Web through Zone.Identifier.
6. VBS stage 5: VBS performs an AMSI and ETW bypass, stores the encrypted payload in environment variables and displays the distraction page CITACION PENAL, FISCALIA.
7. Reconstructible persistence: VBS creates a reversed copy as fake XHTML under %APPDATA%\Microsoft\index_[redacted].xhtml and C:\Users\Public\, plus a Startup-folder shortcut based on SvcConfig[redacted].vbs.
8. PowerShell stage 6: PowerShell decodes the final payload through AES-256-ECB, custom Base85 and GZIP, then loads the native x64 RAT in memory through Reflection and delegates, without relying on a final file persisted to disk.
9. Surveillance modules: the RAT deploys its own virtual desktop through CreateDesktopW, a keylogger based on the active layout through GetKeyboardLayout and ToUnicodeEx, d3d11 screen capture, MFPlat streaming and token impersonation.
10. Remote operation: the operator controls the session through the hidden desktop, can block keyboard and mouse input with BlockInput and exfiltrates judicial and tax documents over an encrypted channel. C2 and cryptographic material are embedded in the client configuration and code.

CATEGORY	INTERNAL VALUE
Persistent XHTML stage	%APPDATA%\Microsoft\index_ZNn4r6.xhtml
Auxiliary copy	C:\Users\Public\
Startup shortcut	SvcConfigZNn4r6.vbs
AMSI/ETW marker	stage-5
Stage 6 transformation	AES-256-ECB -> custom Base85 -> GZIP
Stage 3 hash prefix	efa891[…]
Stage 4 hash prefix	43bf[…]
Stage 5 hash prefix	3bfb[…]

Judicial correspondence

The first message imitates a communication from a Colombian judicial body and presents a case reference, formal language and an XHTML attachment. The body claims that a decision was issued and that the measure is available through a judicial-management system. The combination of authority, urgency and an attached document is suited to induce opening without requiring sophisticated technical interaction.

A second message uses a tutela proceeding and an urgent circular as its theme. The text mentions public contracting and requests that the recipient open a password-protected PDF file. The internal figure preserves the message structure and attachment type, including the original data.

The visible recipients belong to justice, public-administration and education contexts. The set is small and cannot estimate the total reach of the wave. It nevertheless supports target selection compatible with roles that receive judicial acts, circulars, contracts or formal notices.

ARTIFACT	OBSERVED VALUE
Protected file from the administrative circular	9221
Judicial query page	GTH2026
Initial attachment	43262 CONSTANCIA-Despacho.COL.97-126.xhtml
Name shown when executing the dropper	Network Configuration Auditor v2.7.298

The headers show why technical appearance can mislead. In one message, SPF, DKIM and DMARC checks appear as passed for the mail service used. This authenticates the sender’s route through that service, but it does not authenticate the judicial content or the claimed institutional identity.

Another capture shows Exchange message metadata and an attachment, with the original identity and message IDs preserved in the internal version. A complete header or internal transport does not prove that the message is legitimate.

HTML and JavaScript delivery

The XHTML attachment bridges the inbox and an institutional-looking page. When opened, it presents a judicial-process query with a crest, blue header, generation date and case-number field. Figure 2 shows the first page of this flow, with the process identifier visible in the internal version.

The flow moves the recipient from a received message to an interface that appears to confirm that the case exists. During controlled analysis, the page generated the next-stage ZIP locally, explaining why the email gateway never saw the compressed content. The capture does not prove that the page belongs to the named agency. The absence of a visible institutional domain and the presence of a browser blob object prevent treating it as an authentic query.

A second page displays a download-completed message and an access key. The identifier and credential are preserved in the internal figure. The sequence recreates a plausible public-portal experience: query, result, download and key. This design gives the operator a way to move the victim to the next artifact without an explicit technical instruction.

The observed pages are best described as delivery or lure-staging content. Controlled execution confirmed ZIP generation and progression to the next stage, but this does not mean that a real judicial document was downloaded, that the key was accepted by a legitimate system or that the browser executed an exploit.

Obfuscation and decoding

The subsequent flow contains a JavaScript file with a judicial lure name and obfuscated code. The file-identification screen links the displayed name to the technical excerpt analyzed.

The excerpts show character tables, conversion functions, fragmented strings and routines that reconstruct data before using it. This pattern reduces readability, delays triage and may hide URLs, commands or local paths. Figure 12 shows unrelated comments, encoded strings and a decoding routine.

The safe conclusion is that the chain contains an obfuscation and data-reconstruction layer. Redacted or encoded strings are not converted in the public text because the full values could expose operational material.

The pattern can be summarized by the following normalized excerpt. The character table, encoded values and routine that turns the result into a command were removed:

During controlled analysis, the first JavaScript was linked to other ZIPs, JavaScript scripts and VBS files through delivery of the final RAT. The chain was not inferred from a single capture: each stage was compared with the following artifact, its observable effects and the payload configuration. The twenty figures are an editorial selection, not the full laboratory file inventory.

Host reconnaissance

The code creates Scripting.FileSystemObject and WScript.Shell objects and reads variables such as %APPDATA%, %OS%, %NUMBER_OF_PROCESSORS%, %LOCALAPPDATA%, %COMPUTERNAME% and %TEMP%. It also queries Registry keys for Windows installation date, network profile, product name and physical memory.

The following excerpt preserves the logic observed in the readable version but does not include operational variable names, URLs or configuration values:

This set is compatible with System Information Discovery (T1082) and Query Registry (T1012). The simple hashing function may produce a local identifier or support an execution decision, but the capture does not show the final value or the server that would receive it.

Files and directories

The script builds a list of directories localized in English, Portuguese and Spanish, including Downloads, Descargas, Desktop, Escritorio, Documents, Documentos and OneDrive-related paths. These names indicate that the code was prepared to locate files in multilingual environments rather than a single-language installation.

The path-checking function distinguishes folders from files before continuing. This is compatible with File and Directory Discovery (T1083). The final RAT analysis identified collection and exfiltration modules, but observed code capability must not be confused with monitoring a real victim. A second normalized excerpt shows the purpose of the multilingual enumeration:

Execution signals

A more readable version of the same code confirms the general order: object initialization, environment collection, Registry reads, timestamp, memory and decryption routine. The duplication between the obfuscated and readable excerpts, combined with controlled VM execution, increases confidence in the functional interpretation without exposing operational values in the public package.

Controlled execution confirmed that the loader decides whether the host is interesting before proceeding, deletes the initial artifact, manipulates MOTW, writes reconstructible persistence and triggers the PowerShell stage. Analysis of the final RAT also confirmed surveillance, impersonation and remote-control modules. No privilege escalation through a specific technique or lateral movement in a real organization was observed, and those boundaries remain explicit.

Payload and infrastructure

Remote staging, configuration and technical lineage

The infrastructure separates the point that distributes or validates content from the hostname associated with C2. This separation limits the value of address-only blocking, reduces origin exposure and allows a single DNS record to be changed when one component is removed.

Remote staging – Web endpoint

crp2026[.]online appears as a distribution point protected by the Cloudflare proxy. DNS and resolution analysis associated the domain with edge addresses 104[.]21[.]16[.]229 and 172[.]67[.]216[.]190, but these addresses belong to the provider’s shared layer and must not be treated as the operator’s origin.

The operational effect is direct: blocking only the two IPs may affect legitimate traffic and does not remove the origin. Infrastructure analysis indicates that the abuse path should involve Cloudflare and Hostinger, as well as the applicable registrar or DNS service. The available evidence does not show a completed takedown action.

Base64 response

The endpoint capture shows a long Base64 response. The value is preserved in the internal figure, and its form is compatible with content served as a stage, configuration or encoded payload. Another capture shows the textual response OK, suggesting a validation route or simple health check.

Base64 by itself is not encryption and does not prove that content was executed. It may carry data, configuration or a file; distinguishing these requires the original artifact and preserved decoding.

The second node is vpfinal142[.]myvnc[.]com, described in the analysis as a dedicated C&C. The neighborhood query for hostnames from vpfinal138[.]myvnc[.]com through vpfinal146[.]myvnc[.]com found no other active nodes. The OTX, ThreatMiner and urlscan queries also returned no passive history for the hostname.

This supports the reading of new and specific infrastructure, but “no history” does not mean that history never existed. Retention, coverage and the date of each source must be preserved to make the result reproducible. The unique hostname in a dynamic DNS service associated with myvnc[.]com can also be changed without changing the distribution domain.

.NET configuration

The address 45[.]146[.]81[.]142 is the most specific finding in the set. The laboratory scan reported ports 4782, 5357 and 5985. The combination of a C&C-associated port with WSD and WinRM is compatible with an exposed Windows machine administered manually rather than an automated Linux service. Port 3389 was not observed, so RDP administration is not demonstrated by this result.

A passive scan of the /24 range found no other host with port 4782. This negative control reduces the hypothesis of a sibling server in the same range, but does not prove that the address was used exclusively by the operator throughout the period.

Cryptography and certificate

The Client.Settings screens show separate fields for Hosts, Ports, Version, Key, MTX and Certificate. The presence of a key, mutex and certificate is compatible with an individualized client configuration, instance identification and a protected channel. The complete values are operational secrets and are preserved in the internal figures.

The structure can be safely represented by the following configuration excerpt. Actual values are replaced by markers in the public Markdown:

Although the original binary was analyzed in the laboratory, the certificate is not reproduced in the public text. Analysis confirmed the field and its configuration context, but the field name must not be converted into an additional capability without exposing its use chain. The public material records the apparent function and preserves operational values in the internal version.

Protections and build

Static identification shows a PE64 classified as a DLL, compiled in VB.NET for .NET Framework 4.8, with signs of obfuscation, virtualization, modified names and altered build information. These elements make static reading harder and may increase the cost of comparing the artifact with a known family.

The analyzer result is a build fingerprint, not a hash and not attribution. Architecture, language and protection layer are compatible with many .NET RATs and must be combined with code, configuration and network behavior.

AsyncRAT/DCRat lineage

Analysis of the complete corpus classified the final RAT as AsyncRAT forked from DCRat. The classification was built from progression through multiple stages, code and configuration comparison, and behavior observed in separate VMs. The public figures show part of the visual support: there is a Client.Settings class, C2, key, mutex and certificate fields, and classes such as CryptoCore, Packet and MutexControl in Assembly Explorer.

These elements support tool and technical-lineage classification, but they are not exclusive. Public projects, private forks and custom RATs may reuse class names, configuration structures and cryptographic libraries.

Development signatures are more specific than the family name. The corpus preserves the Boss/Client77 and Client77 markers, as well as the sample name client77_rat.bin. They appear alongside a class tree that includes Client.Settings, CryptoCore, MutexControl, Packet, ProcessCritical, IdSender, MsgPack and MsgPackEntry. The co-occurrence of a build marker, project nomenclature and class organization forms a developer or fork fingerprint.

SIGNATURE	EVIDENCE	ANALYTICAL VALUE
Boss/Client77	Development marker	Possible project identity
Client77	Recurring configuration and code name	Links builds and components
client77_rat.bin	Name seen in PE analysis	Sample or build label
Client.Settings	Configuration class	RAT client pattern
CryptoCore and Aes256	Cryptography	Communication component
MutexControl	Instance control	Prevents duplicate execution
Packet, MsgPack and MsgPackEntry	Message structure	Protocol pattern
ProcessCritical and IdSender	Auxiliary classes	Recurring project organization

This combination is a development signature, not automatic attribution to a person. Its weight increases when it appears in more than one sample and coincides with execution order, configuration and RAT protocol.

Fork indicators

The strongest fork indicator is the combination of configuration differences, custom classes, initialization order, packet protocol, build modifications and the Boss/Client77 and Client77 signatures observed in the analyzed binary. The complete chain enabled comparison of intermediate stages with the final RAT instead of relying on a single capture. Values and excerpts that would allow client reproduction remain restricted to the internal version.

The family attribution is presented as “AsyncRAT forked from DCRat”, with high confidence for the technical lineage. The hash, complete strings, configuration method and protocol details were preserved in the analysis environment but are not published in the public version.

Chronology

One query page shows generation on 21 October 2026. Another page shows generation on 27 October 2026. Captured headers record messages on 27 and 30 October 2026. The sequence is consistent with a wave that alternated judicial and administrative lures with query pages over a few days.

The dates belong to the surface shown to the recipient or to email transport. They do not prove when the code, domain or server was created. The approximate five-week domain age and two-week certificate age should be treated as infrastructure observations subject to reproduction.

The names of the twenty captures indicate collection on 1 November 2026. During analysis in separate VMs, the web endpoint, OK response, client configuration and PE profile were observed after following the multiple stages of the chain. This demonstrates component accessibility during the analysis window but does not replace continuous availability measurement.

The infrastructure queries describe a campaign of approximately seven days, a new domain and a recent certificate. The combination of a short window, singular hostname and absence of active DNS neighbors is compatible with a disposable actor building infrastructure for a specific wave.

“Active” is used here to mean recent observed activity, not a guarantee that the C2 or domain will respond when this document is read. Indicator validity must be reassessed before blocking or takedown.

Target selection

Public sector and justice

The lures use judicial agencies, process queries, tutela proceedings, fiscalías and administrative obligations. The language and visual elements are chosen to reach people who have professional reasons to open formal documents, check case numbers or forward circulars.

The judicial theme may be victimology or merely a reused phishing template. The captures prove the intent to look institutional, not that the operator had access to a judicial system or obtained real case data.

Education and contacts

The multiple emails analyzed include recipients associated with education and contacts at public organizations. This is consistent with a campaign that exploits relationships among justice, education and administration. The corpus is not a census of the operation and cannot estimate total reach or sector-level victim proportions.

The combination of Portuguese and Spanish may also reflect the lure’s regional context rather than the operator’s physical location. Language is an auxiliary attribution line, not standalone proof.

Probable objectives

The most likely initial objective is sufficient opening or execution to perform host discovery and establish contact with the payload. Environment collection and the presence of C2 configuration make a later remote-access stage plausible.

Commands, exfiltrated files, stolen credentials, persistence or lateral movement were not observed in the captures. These remain potential RAT risks rather than facts established by this case.

APT-C-36 attribution

The APT-C-36 association is supported by regional lures, use of a .NET commodity RAT, a multi-stage execution chain, observed victimology and a short operation. The infrastructure adds planning signals: distribution behind Cloudflare, a dedicated C2 hostname, a Windows-profile node and no sibling servers in the query performed.

Four lines converge on a Brazilian-operator hypothesis: hosting in Cotia, Brazilian ASN 265919, server timezone America/Sao_Paulo, Portuguese code references and a Portuguese phishing vector. The convergence is stronger for the operational characterization of the cluster than for group identity.

Past operations also showed correlation with a Brazilian operator using the nickname pjoao1578. This campaign has clear indicators of Brazilian operation, but the previous actor cannot be attributed to the new campaign on that basis.

The infrastructure also distinguishes the operation from a simple shared service. vpfinal142[.]myvnc[.]com without active peers in the queried range, together with 45[.]146[.]81[.]142 on port 4782, is more specific than a CDN IP. A rented dedicated server is still not actor identity.

High confidence in the existence of a small and dedicated infrastructure cluster, with protected distribution, a singular C2 and a Windows node compatible with manual administration. This conclusion is supported by correlation among DNS, passive DNS, scanning, RAT configuration and controlled observation of the stages. It does not prove that every open service was used for command and control without correlation to the client or traffic.

High confidence in the Brazilian-operator hypothesis, because hosting, ASN, timezone, code language and lure language converge. This confidence does not identify a person, company or responsible provider and does not eliminate false flag, VPS purchase or deliberate regional configuration.

High confidence in attributing the campaign to APT-C-36, based on convergence among multiple lures, the execution chain, TTPs, code, AsyncRAT/DCRat lineage, victimology and analyzed infrastructure. This confidence does not identify a person, does not turn operational nationality into individual identity and does not cover every activity using the same malware family. AsyncRAT/DCRat is a technical payload conclusion, while APT-C-36 is the operation-level assessment.

MITRE ATT&CK mapping for the chain

STAGE OR BEHAVIOR	TECHNIQUE	OBSERVED APPLICATION
Initial email	T1566.001, Spearphishing Attachment	Judicial XHTML attachment
File opening	T1204.002, User Execution: Malicious File	Victim execution
Browser-generated ZIP	T1027.006, HTML Smuggling	Content created on the client
Dropper name and appearance	T1036, Masquerading	Network Configuration Auditor
Noise and encoded strings	T1027, Obfuscated/Compressed Files	Markers and character table
JavaScript	T1059.007, JavaScript	Dropper and decoding
VBS	T1059.005, Visual Basic	Stage 5 and persistence
PowerShell	T1059.001, PowerShell	Stage 6 and loading
Stage delivery	T1105, Ingress Tool Transfer	Component chaining
Multilayer decoding	T1140, Deobfuscate/Decode Files or Information	AES, Base85 and GZIP
XHTML deletion	T1070.004, File Deletion	Removal of the initial artifact
MOTW removal	T1553.005, Mark-of-the-Web Bypass	Zone.Identifier manipulation
Startup Folder	T1547.001, Registry Run Keys / Startup Folder	Reconstructible VBS
AMSI and ETW bypass	T1562.001, Impair Defenses	Reduced defensive visibility
Fileless loader	T1620, Reflective Code Loading	Reflection and delegates
Keylogging	T1056.001, Keylogging	Active layout and key conversion
Screen capture	T1113, Screen Capture	d3d11 capture
Video streaming	T1125, Video Capture	MFPlat pipeline
Impersonation	T1134.001, Token Impersonation/Theft	Session tokens
Local documents	T1005, Data from Local System	Judicial and tax files
Encrypted channel	T1573.001, Symmetric Cryptography	C2 and exfiltration
Exfiltration	T1041, Exfiltration Over C2 Channel	RAT channel output

Capabilities and impact

The JavaScript performs environment reconnaissance before the final objective is known. It queries environment variables, Windows product and version, network profile, installation date, computer name, memory and localized directories. This may allow the operator to filter machines, avoid analysis environments or select a next action.

Risk is higher on workstations that receive judicial or administrative documents and have access to mailboxes, case-management systems, shares or work credentials. The analyzed chain reaches modules that search local documents, capture the screen and record keystrokes, so directory enumeration is not merely abstract probing. It prepares collection of judicial and tax data.

Remote access

Host, port, key, mutex and certificate fields, together with the node reported at 45[.]146[.]81[.]142, indicate an architecture prepared for remote communication. Port 4782 is treated in the analysis as C&C, while 5985 exposes WinRM and 5357 is compatible with WSD. Controlled execution confirmed the encrypted channel and remote-control function set, although an open port alone does not prove callback to a real organization.

The PE64 payload in VB.NET and .NET Framework 4.8 implements fileless loading of the x64 RAT and surveillance modules. Analysis confirmed its own virtual desktop, BlockInput, keylogging, d3d11 screen capture, MFPlat streaming, token impersonation and control through the encrypted channel. These capabilities were observed in the artifact and controlled execution, but they do not prove use against a real organization.

Potential impact

If the chain completes on a real workstation, impacts include environment reconnaissance, document collection, remote access, keystroke and screen capture, token impersonation and use of the workstation as an entry point to other systems. In public organizations, exposure may involve case information, contracts, personal data and institutional trust.

The impact demonstrated in the laboratory is the complete chain capability, including reconstructible persistence, AMSI and ETW bypass, fileless loading, surveillance and exfiltration over encrypted C2. Execution occurred in a controlled environment, not on a victim workstation. There is no evidence of compromise, effective persistence or lateral movement in a real organization. This distinction must remain explicit in any public disclosure.

Conclusion

This campaign represents a complete APT-C-36 intrusion chain designed to move from trusted judicial-themed communication to persistent remote access. The operation combines SVG-disguised XHTML, browser-side HTML Smuggling, ZipCrypto delivery, JavaScript and VBS staging, AMSI and ETW bypass, reconstructible persistence, PowerShell-based multilayer decoding and fileless loading of the final x64 RAT.

The final payload provides the operator with direct surveillance and control capabilities, including a private desktop, keyboard and mouse blocking, keylogging, screen capture, media streaming, token impersonation, local document collection and encrypted C2-based exfiltration. The targeting of judicial, fiscal, administrative and educational organizations gives the operation access to highly sensitive legal, financial and institutional information.

The infrastructure was built as a compartmentalized operational system. crp2026[.]online protected distribution behind Cloudflare, while vpfinal142[.]myvnc[.]com resolved to the dedicated Windows node 45[.]146[.]81[.]142, exposing ports 4782, 5357 and 5985. The absence of sibling C&C nodes across the queried hostname range and /24 network reinforces the assessment of a purpose-built, single-node operation created for this campaign.

The malware development fingerprint is equally significant. Boss/Client77, Client77, client77_rat.bin, Client.Settings, CryptoCore, MutexControl, MsgPack and related classes recur across the analyzed components and establish continuity between the build, configuration and final RAT. Combined with the Portuguese and Spanish lures, Brazilian infrastructure, operational timezone and regional victimology, these elements establish the campaign as an APT-C-36 operation conducted through a Brazilian operational cluster.

The campaign demonstrates that commodity RATs remain highly effective when combined with disciplined delivery engineering, browser-side archive generation, multilayer obfuscation, security-control impairment and dedicated infrastructure. Organizations across Latin America should treat judicial-themed XHTML files, browser-generated ZIP downloads, JavaScript and VBS stages, anomalous PowerShell decoding, hidden desktop activity and the Client77 development signatures as high-priority hunting targets.