The SVG file drops a ZIP archive created with BatCloak ... from VenomRAT's C2 using three methods: an obfuscated VBS script named 'remcos.vbs,' ScrubCrypt, and Guloader PowerShell," they added.