How to get rid of DenoRAT malware

What kind of malware is DenoRAT?

DenoRAT is a Remote Access Trojan (RAT) that also steals information from infected computers. It is written in Deno JavaScript and consists of over 10,000 lines of code, much of it obfuscated to resist analysis.

According to research published by eSentire, DenoRAT is part of the toolkit used by a threat actor known as TAG-150, active since at least March 2025. The malware is delivered through a ClickFix social-engineering lure that tricks victims into running a malicious command on their own machines.

Once running, DenoRAT gives attackers live remote control over the infected system. It also steals saved browser passwords, cookies, credit card data, cryptocurrency wallet contents, and account tokens for applications like Telegram and Discord.

DenoRAT malware overview

DenoRAT runs on the Deno JavaScript runtime, a platform not typically found on everyday computers. Its code is heavily obfuscated using Obfuscator.io, making it harder to analyze with standard security tools. The malware communicates with the attacker's server over HTTP polling and WebSocket connections.

When connecting, DenoRAT registers the infected device using a hard-coded JWT token embedded in the malware code. The token contains campaign-specific identifiers, such as a build ID and build note, which allow TAG-150 to track individual deployments and victims separately.

DenoRAT's capabilities

DenoRAT gives attackers an extensive set of remote control tools. Operators can run shell commands through cmd.exe and PowerShell, stream a live view of the victim's desktop, and control the mouse, keyboard, and clipboard remotely. The malware can also capture screenshots on demand and manage files on the infected system.

On the information-stealing side, DenoRAT harvests credentials from Chromium and Firefox-based browsers, including saved passwords, cookies, and credit card numbers. It supports App-Bound Encryption bypass, which lets it access Chrome's locally stored credential database even when that protection is active.

The malware targets over 78 browser extensions across several categories. These include password managers such as Bitwarden, 1Password, LastPass, and Dashlane; two-factor authenticator apps such as Google Authenticator and Authy; and cryptocurrency wallet extensions including MetaMask, Phantom, Trust Wallet, and Exodus.

Session tokens for Telegram and Discord are also collected. The malware additionally gathers basic system information from the victim's machine, including the username, hostname, OS version, hardware specs, and administrator status.

Persistence and defense evasion

DenoRAT maintains access to infected systems through the Windows Registry. It creates a Run key entry under HKCU that uses conhost.exe to silently launch the Deno runtime on every login, keeping the malware active after reboots.

To avoid detection, DenoRAT checks for the presence of ESET security software before acting. If ESET is detected, it skips its DLL injection routine entirely. Without ESET present, it injects a DLL into a suspended Chromium browser process to bypass App-Bound Encryption and access stored credentials.

The malware also manipulates the Process Environment Block (PEB) to mislead security products analyzing the running process. JavaScript obfuscation via Obfuscator.io adds another layer of protection against automated analysis.

DinDoor loader and NightshadeC2

DenoRAT does not arrive alone. It is one stage in a multi-part attack chain attributed to TAG-150. The first component is DinDoor, a small Deno-based loader whose job is to fetch and execute the DenoRAT stager from the attacker's server.

In some campaigns, DenoRAT then delivers a further payload called NightshadeC2. This is a full-featured RAT and infostealer that is executed entirely in memory using a Python-based reflective PE loader. The payload is decrypted using AES-256-CBC before execution, leaving fewer artifacts on disk.

Conclusion

DenoRAT gives attackers both remote control over infected systems and a broad range of data-theft capabilities. Its multi-stage delivery chain, active evasion of security software, and registry persistence make it a particularly dangerous threat.

Victims risk losing saved browser passwords, cryptocurrency holdings, account tokens, and credit card details. Combined with the ability to deploy additional payloads such as NightshadeC2, DenoRAT should be removed from any infected system immediately.

More examples of RATs are RemotePE, LabubaRAT, and MODBEACON.

How did DenoRAT infiltrate my computer?

According to eSentire, TAG-150 delivers DenoRAT using ClickFix social engineering. A victim encounters a page that claims they must verify themselves or fix an error, and is instructed to open the Windows Run dialog and paste a command. Executing that command silently downloads and runs an MSI installer.

The MSI installs the Deno runtime and deploys DinDoor. A PowerShell script acts as an intermediate stage in this chain. TAG-150 tracks victims across campaigns by embedding build-specific identifiers into each deployment.

More broadly, threats of this type also reach victims through phishing emails carrying malicious attachments, fake software download sites, pirated content, and malvertising. Common file formats in such attacks include archives (ZIP, RAR), executable files, and documents such as PDFs and Office files.

How to avoid installation of malware?

Be cautious with unexpected emails and messages, especially those urging you to open an attachment, click a link, or paste a command. Avoid running commands from websites into the Windows Run dialog, PowerShell, or any terminal - this is the exact delivery method used by DenoRAT. Only download software from official sources and avoid pirated content, key generators, and cracks.

Keep your operating system and all installed applications up to date, as updates often patch vulnerabilities attackers rely on. Use reputable security software and run regular scans. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is DenoRAT?
• STEP 1. Manual removal of DenoRAT malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with DenoRAT malware, should I format my storage device to get rid of it?

Formatting will remove DenoRAT but will also erase all files on the drive. Running a reputable security tool such as Combo Cleaner is a safer first step that does not put your data at risk.

What are the biggest issues that DenoRAT malware can cause?

DenoRAT can steal saved browser passwords, cookies, credit card data, cryptocurrency wallet contents, and session tokens for Telegram and Discord. Its remote control features can lead to identity theft, account takeover, and financial loss. Additional payloads such as NightshadeC2 can also be deployed to the infected system.

What is the purpose of DenoRAT malware?

The purpose of DenoRAT is to give the TAG-150 threat actor remote control over infected machines and to steal a wide range of sensitive data. It also acts as a staging platform for additional payloads, including the NightshadeC2 infostealer and RAT.

How did DenoRAT malware infiltrate my computer?

DenoRAT is distributed using ClickFix social engineering, where victims are tricked into pasting a command into the Windows Run dialog. This silently downloads and runs an MSI installer that sets up the Deno runtime and deploys the DinDoor loader, which then installs DenoRAT.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware, including threats like DenoRAT. Because this malware uses a multi-stage delivery chain, a full system scan is recommended to make sure all components are removed.