ResolverRAT: The In-Memory RAT That Loads Itself Off the Disk’s Radar

ResolverRAT is a previously undocumented, highly evasive .NET remote-access trojan disclosed by Morphisec in April 2025, observed in targeted phishing against healthcare and pharmaceutical organisations worldwide. Its defining trait is almost entirely in-memory operation: a legitimate signed binary side-loads a malicious DLL, which then abuses .NET’s runtime resolver mechanisms to load its real payload from encrypted resources at runtime, avoiding on-disk payloads and the API calls monitoring tools watch. It pairs this with heavy obfuscation, sandbox fingerprinting, redundant persistence and a certificate-pinned C2 channel.

Overview

Morphisec disclosed ResolverRAT around 14 April 2025, with the largest observed wave on 10 March 2025. It is unattributed: Morphisec noted the phishing infrastructure and lure themes overlap with campaigns linked to Rhadamanthys and Lumma distribution, but assessed ResolverRAT as a distinct family — shared infrastructure may point to a shared distributor rather than shared authorship.

How It Works

• Side-loading: a lure link delivers a legitimate signed executable, hpreader.exe (a Haihaisoft PDF Reader component), abused for DLL side-loading. T1574.002
• Resolver abuse: the side-loaded DLL decrypts and reflectively loads its core assembly, hijacking .NET resource and assembly resolution so dependencies load from attacker-controlled encrypted resources rather than disk. T1620 T1140
• Redundant persistence: XOR-obfuscated keys written to as many as 20 registry locations plus multiple filesystem copies, so removing one does not evict it. T1547.001
• Evasion: AES-256-encrypted payload and config, control-flow obfuscation via a state machine, and sandbox and analysis-tool fingerprinting. T1027 T1497
• Exfiltration serialised with Protocol Buffers and sent in small chunks over a certificate-pinned TLS channel with jittered beaconing and IP-rotation fallback. T1573 T1041

Delivery & Targeting

Delivery is localised phishing — often posing as legal or copyright-infringement notices crafted in the target’s local language, reported across English, Hindi, Italian, Indonesian, Turkish, Portuguese and Czech — aimed at healthcare and pharmaceutical organisations globally. No named victims or hard counts were published. T1566.002

MITRE ATT&CK Mapping

Detection & Mitigation

• Hunt for hpreader.exe running from unusual paths or side-loading a non-Haihaisoft DLL — a strong signal.
• Deploy EDR rules for reflective in-memory .NET assembly loading and resolver abuse, and alert on mass redundant autostart registry writes with obfuscated values.
• Inspect TLS sessions whose certificates do not chain to trusted roots and flag jittered beaconing; tune phishing controls for localized legal and copyright lures in healthcare and pharma.