DarkMe
DarkMe is a Visual Basic/VB6 remote-access trojan and spy trojan associated with the financially motivated threat activity tracked as Evilnum and later linked with high confidence to Water Hydra / DarkCasino. Reporting states the malware has been used in campaigns targeting forex traders, stock traders, and financial trading platforms, with related Water Hydra victimology also including banks, cryptocurrency platforms, gambling sites, and casinos. DarkMe has been distributed through trading forums, stock-trading Telegram channels, file-sharing services, and exploit-driven delivery chains.
Documented delivery vectors include exploitation of WinRAR zero-day CVE-2023-38831 using specially crafted archives masquerading as benign files such as .jpg or .txt, and Water Hydra’s use of CVE-2024-21412 Internet Shortcut/SmartScreen bypass chains to deliver DarkMe. In January 2024, Trend Micro reported Water Hydra streamlined DarkMe infection through a malicious .MSI stage. Broader 2026 reporting also describes forex-themed multi-stage loaders using PowerShell and script-based loaders, AMSI bypasses, AES-encrypted payload retrieval from GitHub, and fileless .NET assembly loading in campaigns where DarkMe tooling remained active.
DarkMe samples analyzed across 2023-2026 shared a stable VB6 lineage, including nine samples with imphash 3e847ec4ad926dd89c2f4cb28d036c11. The DarkMe builder was reportedly compiled on 2022-05-01 22:07:11 UTC and was still generating active malware in March 2026. Three 2026 samples shared PE timestamp characteristics, entry point 0x12C4, and .text SHA256 6ca93b13b5db11414c6ab928aa0243b65927fcce20c16f9bdcfdddd9461726ce. Reporting also notes a shared embedded VB6 type library path, C:\Users\Administrator\Desktop\vaeeva\shellrundll.tlb, across a 2022 Evilnum-linked DLL and a 2024 WaterHydra payload, supporting linkage between Evilnum, DarkCasino, Water Hydra, and later activity.
Observed DarkMe functionality includes command handling via reversed UTF-16LE strings such as EXELHS for shell execution and OLAPIZ for ZIP archive creation. It uses custom TCP communications over a SOCKET_WINDOW class; sandbox analysis confirmed UDP traffic to 38.57.44.173:4242 in one case. Every analyzed DarkMe sample reportedly used the literal cleartext C2 password string "password." Persistence observed for EXE variants used HKLM...\RunOnce*RD_, while a 2024 WaterHydra MSI/DLL variant persisted via HKCU...\Run\HomeDLL using rundll32 /sta {AAE802DB-FB67-4407-A175-61223EFF30D4}. Related investigations reconstructed active C2 evolution and confirmed infrastructure including 91.124.98.29:2626 live during a 2026 investigation.
Code artifacts in the DarkMe codebase included multiple Italian-language strings such as ciapa, tuttidati, segreto, stocavoloccio, squola, estatolui, and zalone; one report assessed the developer may be bilingual Italian/Spanish based on these artifacts, locale 0x0C0A, and a Spanish WinSock error string. Later reporting states Water Hydra removed some earlier attribution artifacts, including the "DarkMe" mutex string, but retained the embedded type library path noted above.
Operational impact described in the reporting includes unauthorized access to victims’ broker accounts, illicit financial transactions, and fraudulent fund withdrawals. High-confidence indicators directly mentioned in the content include C2 91.124.98.29:2626, UDP traffic to 38.57.44.173:4242, imphash 3e847ec4ad926dd89c2f4cb28d036c11, .text SHA256 6ca93b13b5db11414c6ab928aa0243b65927fcce20c16f9bdcfdddd9461726ce, the cleartext C2 password "password," the VB6 type library path C:\Users\Administrator\Desktop\vaeeva\shellrundll.tlb, and persistence artifacts including HKLM...\RunOnce*RD_ and HKCU...\Run\HomeDLL with rundll32 /sta {AAE802DB-FB67-4407-A175-61223EFF30D4}.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The group's DarkMe VB6 builder -- compiled in May 2022 -- is still producing active malware in March 2026, and their C2 at 91.124.98.29:2626 was confirmed live at time of investigation.
The group's DarkMe VB6 builder -- compiled in May 2022 -- is still producing active malware in March 2026, and their C2 at 91.124.98.29:2626 was confirmed live at time of investigation.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The group's DarkMe VB6 builder -- compiled in May 2022 -- is still producing active malware in March 2026, and their C2 at 91.124.98.29:2626 was confirmed live at time of investigation.
The group's DarkMe VB6 builder -- compiled in May 2022 -- is still producing active malware in March 2026, and their C2 at 91.124.98.29:2626 was confirmed live at time of investigation.
The group's DarkMe VB6 builder -- compiled in May 2022 -- is still producing active malware in March 2026, and their C2 at 91.124.98.29:2626 was confirmed live at time of investigation.
"...trick financial traders into ultimately infecting their PCs with DarkMe – a remote-access trojan seeded in forex trading forums and stock trading Telegram channels."
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniquesMITRE ATT&CK T1583.003 — Virtual Private Server (PFCLOUD, ThinkHuge, OMEGATECH)
MITRE ATT&CK T1588.004 — Digital Certificates (fake Microsoft Publisher certs)
Initial Access
1 techniqueThe malware was distributed alongside other malware families, such as GuLoader and Remcos RAT, via malicious ZIP archives posted on popular trading forums or distributed via file-sharing services.
Execution
6 techniquesThe Sentinel variant is delivered via a 779KB PowerShell wrapper ( sentinel.ps1 ) that: Requests admin elevation via UAC prompt Decompresses a GZip-compressed .NET PE from an embedded byte array Writes to SubDir\Sys.exe and registers as "Runtime Broker" in HKCU\Run
Group-IB Threat Intelligence unit discovered a zero-day vulnerability, CVE-2023-38831, in WinRAR... Cybercriminals exploited this vulnerability to deliver various malware families... When victims opened the specially crafted archive, it executed the malware.
"... abused this bypass flaw to trick financial traders into ultimately infecting their PCs ... seeded in forex trading forums and stock trading Telegram channels."
Persistence
2 techniquesPrivilege Escalation
2 techniquesStealth
3 techniquesThe exploit allowed them to spoof file extensions, hiding the launch of malicious scripts within an archive masquerading as a '.jpg', '.txt', or any other file format.
MITRE ATT&CK T1140 — Deobfuscate/Decode (8 crypto schemes, 2-layer AES nesting)
MITRE ATT&CK T1218.005 — Mshta (OneDriveSync.hta, COM scriptlet)
Command and Control
1 techniqueMITRE ATT&CK T1573.001 — Encrypted Channel: Symmetric (AES-256-CBC C2)
Exfiltration
1 techniqueMITRE ATT&CK T1567 — Exfiltration Over Web Service (GitHub payload hosting)
IOCs tracked for this family
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
DarkMe is a RAT used by the same operator across historical infrastructure from 2023 through 2026. The report describes DarkMe VB6 payloads delivered through layered AES-wrapped loaders, COM scriptlets, PowerShell, and JavaScript, with multiple persistence mechanisms and evolving C2 infrastructure.
A Visual Basic 6 remote access trojan built with a compile-once, patch-config builder model. It supports command execution, directory listing, file operations, ZIP archive creation, suspected screenshot capture, persistence via Run/RunOnce and COM registration, and custom TCP/UDP C2 communications using reversed UTF-16LE command strings.
VB6 OCX/DLL implant used in intrusions possibly related to Deathstalker; delivery shifted from Skype to Telegram and OPSEC/cleanup improved.
Trojan payload deployed by the Water Hydra/DarkCasino threat actor as part of an attack chain (delivered after exploiting vulnerabilities, including prior WinRAR zero-days).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.