When Environment Variables Met Steganography: Inside a Reusable DCRat Delivery Chain

This analysis documents a multi-stage malware campaign that begins with an obfuscated ZIP/VBS loader which stages a PowerShell payload in a user environment variable, downloads PNG files containing appended steganographic payloads, reconstructs and reflectively loads a .NET loader that injects a DCRat executable into msbuild.exe, and implements evasion (AMSI bypass, anti-VM/process checks), persistence (scheduled tasks/registry), TCP C2 communication, and includes multiple IoCs.