This threat advisory analyzes the INOCNATION malware campaign and the RAT used, highlighting a layered design built to evade discovery and frustrate analysis. The attack starts with a dropper that writes and runs both a RAT installer and a legitimate Cisco AnyConnect installer decoy, using XOR obfuscation that skips null and key bytes to hinder extraction. The RAT installer includes sandbox detection via mouse-movement checks, drops an obfuscated DLL payload with a deliberately mangled MZ header that is later repaired, establishes persistence via a Run registry key, deletes itself, and executes the payload through regsvr32. The implant uses Unicode string stacking plus multiple XOR layers and SSL/TLS for C2 traffic, supports commands like reverse shell, file transfer, system info, and unin

Join for free to read