Malware

DarkCloud

DarkCloud is a Windows information-stealing malware family first observed in 2022 and commonly referred to as DarkCloud Infostealer. It is widely described as a low-cost commercial infostealer sold via Telegram, public storefronts, and dedicated websites, including offerings attributed to the seller @BluCoder; reporting also states it was previously sold on the Russian-language forum XSS.is. Multiple sources describe DarkCloud as written in Visual Basic 6.0/VB6, including a rewritten v4.2 variant identified in September 2025. It has been distributed in phishing campaigns, including emails themed as financial correspondence or SWIFT MT103 messages carrying malicious ZIP or RAR archives, and has also appeared as a payload delivered by intermediary loaders such as PhantomVAI/PanthomVAI and shared AutoIt-based crypter chains. Reported delivery chains include obfuscated JavaScript, PowerShell, archive.org-hosted images with embedded code, .NET loaders masquerading as Microsoft.Win32.TaskScheduler, and process hollowing into legitimate processes such as MSBuild.exe.

DarkCloud is designed to steal a broad range of personal and corporate data. High-confidence reporting states it can collect browser credentials, cookies, credit card/payment data, browser information, email client information and contacts, FTP credentials, keylogging data, clipboard contents, screenshots, document files, and cryptocurrency wallet information. Specific targeted software and data sources mentioned in reporting include Chromium-based browsers such as Google Chrome, Microsoft Edge, and Brave; browser SQLite databases such as Login Data and WebData; FTP clients FileZilla and WinSCP; and email clients including Thunderbird, MailMaster, and eM Client. One analyzed sample dropped vbsqlite3.dll into C:\Users\Public\Libraries\ to access SQLite browser databases, used GetAsyncKeyState/GetForegroundWindow/GetWindowTextA for keylogging, queried showip.NET for public IP discovery, and staged stolen data into local text files.

Exfiltration methods vary by campaign and version. Across the reporting, DarkCloud is described as exfiltrating stolen data via Telegram Bot API, FTP, SMTP/email, HTTP POST, and PHP-based web panels. One March 2026 sample exfiltrated simultaneously through Telegram Bot API, FTP upload, and HTTP POST, using api.telegram.org and a hardcoded multipart/form-data boundary string 3fbd04f5-b1ed-4060-99b9-fca7ff59c113. A July 2025 campaign analyzed by Fortinet used SMTP over TLS to send stolen files as email attachments, with the subject containing victim host, user, and IP details. Persistence and anti-analysis behaviors reported for DarkCloud include HKCU Run or RunOnce registry persistence, self-deletion via cmd /C cleanup commands, extensive encrypted strings, RijndaelManaged-encrypted configuration values, and sandbox evasion based on waiting for real keyboard and mouse activity.

DarkCloud has been observed in campaigns targeting both individuals and businesses, with explicit reporting of attacks against manufacturing-sector victims. It is also repeatedly referenced as one of several payloads delivered by broader phishing and loader ecosystems alongside malware such as AsyncRAT, Remcos, XWorm, SmokeLoader, AgentTesla, and FormBook. Notable indicators and artifacts directly mentioned in reporting include the internal banner string "===============DARKCLOUD===============", sample SHA-256 hashes 4ff1f0ed9795f7f3990891bd6cf7e3dd317de240958b6a4731606aa0c5d61220, 82BA4340BE2E07BB74347ADE0B7B43F12CF8503A8FA535F154D2E228EFBEF69C, and infrastructure such as hxxp://paste[.]ee/d/0WhDakVP/0, hxxps://archive[.]org/download/universe-1733359315202-8750/universe-1733359315202-8750.jpg, and api.telegram.org. Reported phishing artifacts include sender procure@bmuxitq(.)shop and attachment names such as "Swift Message MT103 FT2521935SVT.zip" and "Quote #S_260627.RAR".

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

In email-based distribution cases, AgentTesla and DarkCloud were identified.

T1566.001Spearphishing AttachmentEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Initial Access Phishing: Spearphishing Attachment T1566.001 Email with "Bank slip.exe", "Payment Advice.exe"

Execution

1 technique

T1059.010AutoHotKey & AutoITEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution Command and Scripting: AutoIt T1059.010 AutoIt-compiled loader with WRSJLIM cipher

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 RunOnce registry key

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Process Injection T1055 VirtualAlloc RWX + DllCallAddress shellcode execution

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 RunOnce registry key

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence3

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Obfuscated Files or Information T1027 Three-layer encryption: WRSJLIM + XOR + Rijndael

T1027.003SteganographyEvidence1

Threat actors in Q4 reused the same inexpensive, off the shelf components across multiple campaigns, combining obfuscated scripts, archive.org hosted images carrying embedded code, and a .NET loader to deliver different payloads.

T1055Process InjectionEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Process Injection T1055 VirtualAlloc RWX + DllCallAddress shellcode execution

T1070.004File DeletionEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Indicator Removal: File Deletion T1070.004 Self-deletion via cmd /C @RD /S /Q

Credential Access

5 techniques

T1003OS Credential DumpingEvidence1

"DarkCloud... quietly harvests sensitive data, including browser logins, cookies, financial information, and contact details... focuses on extracting credentials and sensitive data from infected machines."

T1056.001KeyloggingEvidence2

DarkCloud can collect document files, keylogging data, email client information, browser information, screenshots, and cryptocurrency wallet information.

T1555Credentials from Password StoresEvidence1

“Multiple information stealer families… demand for off-the-key stealer malware… stealer logs… sold to initial access brokers”

T1555.003Credentials from Web BrowsersEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Credential Access Credentials from Password Stores: Web Browsers T1555.003 SQLite-based theft of Chrome, Edge, Brave credential databases

T1555.005Password ManagersEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Credential Access Credentials from Password Stores: FTP Clients T1555.005 FileZilla XML parsing, WinSCP registry extraction

Collection

2 techniques

T1056.001KeyloggingEvidence2

DarkCloud can collect document files, keylogging data, email client information, browser information, screenshots, and cryptocurrency wallet information.

T1113Screen CaptureEvidence1

DarkCloud can collect document files, keylogging data, email client information, browser information, screenshots, and cryptocurrency wallet information.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

"a loader named PhantomVAI ... used ... to deploy other payloads, such as Remcos RAT, XWorm, AsyncRAT, DarkCloud, and SmokeLoader"

Exfiltration

2 techniques

T1048Exfiltration Over Alternative ProtocolEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Exfiltration Exfiltration Over Alternative Protocol T1048 FTP upload via FtpPutFileA

T1567Exfiltration Over Web ServiceEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Exfiltration Exfiltration Over Web Service T1567 Telegram Bot API sendDocument + HTTP POST gate

INDICATORS OF COMPROMISE

IOCs tracked for this family

14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

7 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

uri●●●●●●●●●●●●View more in app2 months ago

hash.md5●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

ahnlab asec blogNews

Jun 16, 2026

May 2026 Infostealer Trend Report - ASEC

Infostealer distributed via email that collects documents, keystrokes, email client data, browser data, screenshots, and cryptocurrency wallet information.

watchguardNews

Apr 20, 2026

FormBook Malware Uses Phishing, DLL Side-Loading, JavaScript

Named as one of the malware families previously delivered by the PanthomVAI loader.

breakglass intelNews

Mar 12, 2026

DarkCloud Stealer via AutoIt Crypter-as-a-Service: Three Encryption Layers, Triple-Channel Exfiltration, and a XAMPP Panel That Ties 25 Samples Together - Breakglass Intelligence - Breakglass Intelligence

VB6-compiled infostealer that steals browser credentials, FTP client credentials, and keystrokes, uses RunOnce persistence, drops vbsqlite3.dll to access SQLite browser databases, and exfiltrates data via Telegram Bot API, FTP, and HTTP POST.

scworldNews

Mar 10, 2026

DarkCloud infostealer lowers cybercrime barrier with $30 price tag | brief | SC Media

Credential-harvesting infostealer marketed as surveillance software. It collects browser logins/cookies, financial data, and email application contact details; stores data locally and exfiltrates via email, FTP, Telegram, or HTTP uploads. Uses legacy Visual Basic 6.0 and older runtime components plus string encryption/obfuscation to hinder detection and analysis.

+10 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching14

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.