Protego

Protego is a sophisticated C# remote access trojan (RAT) associated with the Patchwork APT group (APT-Q-36). It is delivered through malicious LNK files disguised as PDF documents and uses Rust-based loaders with shellcode decryption. The malware establishes two-stage communication with C2 servers, collects system information including hostname, username, device UUID, and OS details, and supports extensive remote control capabilities including file operations, process management, and memory execution.