LIVING OFF DENO

Report summary

This report documents an investigation into DinDoor, a multi-stage backdoor that leverages the Deno JavaScript runtime to deploy a modular Remote Access Trojan (RAT) through a series of in-memory JavaScript loaders. Through threat hunting, we identified 37 related MSI installer samples, reconstructed the complete infection chain, documented a change in the malware installer build pipeline, and performed a function-level analysis of the final RAT. At the time of writing, the campaign remained active. The infection chain begins with a trojanised MSI installer that executes a CMD launcher and a PowerShell loader to install the Deno runtime before transitioning into multiple memory-resident stages. Unlike conventional malware that relies on a single loader, the framework separates execution into two lightweight JavaScript launchers.

Analysis of the second-stage launcher revealed functionality extending beyond simple payload delivery. Before deploying the final RAT, the malware establishes persistence by storing the first-stage launcher and creating a Windows Run registry entry, generates a unique host identifier, prevents duplicate execution through a mutex, identifies a responsive command-and-control (C2) server, and registers the compromised host. The launcher then downloads and executes the final RAT directly from memory by spawning a Deno process and supplying the payload through standard input, avoiding the need to write the final stage to disk.

Further analysis of the final payload demonstrates that the malware implements a fully-featured modular RAT capable of browser credential theft, cryptocurrency wallet theft, file collection, remote desktop functionality, pseudo-terminal access, host reconnaissance, and command execution. Rather than embedding functionality directly into a single binary, the malware uses a centralised task dispatcher that dynamically invokes individual modules based on commands received from the C2 server, allowing threat actors to selectively deploy capabilities during post-compromise operations.

This research reconstructs the complete infection chain: from the initial installer through both JavaScript launchers to the final RAT, and documents the internal communication workflow between each stage. By analysing the malware beyond its initial loader, the report provides insight into its persistence mechanism, in-memory execution model, modular architecture, and operational workflow, highlighting how modern JavaScript runtimes such as Deno can be leveraged to build flexible and stealthy malware frameworks that reduce forensic artefacts while enabling rapid updates to post-exploitation capabilities.

DinDoor Delivery Chain – from MSI installer to main RAT

Read the full research here.