Loading malware…
DarkMe RAT is a Windows-focused Visual Basic 6 remote-access trojan associated with the Water Hydra, also known as DarkCasino, threat activity. Campaign activity surged in February 2024 and exploited CVE-2024-21412. Observed execution chains use a shortcut-based lure, remotely retrieved scripts and installer components, COM registration, layered decryption, and process hollowing to launch the final obfuscated payload. DarkMe establishes persistence through COM registration and a current-user Run entry. It collects host and user identifiers, victim country, installed antivirus products, and foreground-window titles, then transmits collected information to its command-and-control infrastructure over socket-based communications. The implant supports asynchronous command execution, including shell execution, file and directory operations, directory enumeration, archive creation, and system reconnaissance. DarkMe uses encoded strings, garbage code, control-flow obfuscation, and process hollowing to hinder analysis and detection.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day CVE-2024-21412 by the hacking group Water Hydra.
DarkMe RAT is the signature malware of the WaterHydra/DarkCasino APT group. Seven DarkMe samples were found sharing the same C2 IP as the QuasarRAT deployment. DarkMe is a custom VB6 RAT with reversed UTF-16LE command strings, a SOCKET_WINDOW class for asynchronous C2 communication, and a command set including shell execution (SHLEXE), file operations, directory mapping, ZIP archive creation, and system reconnaissance.
DarkMe RAT is the signature malware of the WaterHydra/DarkCasino APT group. Seven DarkMe samples were found sharing the same C2 IP as the QuasarRAT deployment. DarkMe is a custom VB6 RAT with reversed UTF-16LE command strings, a SOCKET_WINDOW class for asynchronous C2 communication, and a command set including shell execution (SHLEXE), file operations, directory mapping, ZIP archive creation, and system reconnaissance.
36 distinct techniques documented for this family, organized by ATT&CK tactic.
MITRE ATT&CK Mapping Technique ID Usage Spearphishing Link T1566.002 Forex forum posts, Telegram trading channels
MITRE ATT&CK Mapping Technique ID Technique Usage T1059.001 PowerShell Multi-stage PS1 loaders with AMSI bypass
A URL-hosted batch script downloads the MSI file into the %temp% folder and starts its execution.
MITRE ATT&CK Mapping Technique ID Technique Usage T1059.005 Visual Basic DarkMe VB6 RAT, forex.sct COM scriptlet
A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day (CVE-2024-21412) by the hacking group Water Hydra.
Execution of DarkMe RAT starts from a Windows Shortcut File (LNK)... The Windows Shortcut File (LNK) displays an image related to a stock trading graph to distract the user while a malicious batch script from a URL is executed in the background.
The “info.txt” file contains registry entries to register the COM DLL “soundtrack.ocx” with CLSID “AAE802DB-FB67-4407-A175-61223EFF30D4.” The registered COM DLL is executed by “rundll32” with the CLSID.
DarkMe EXE variants write to HKLM\...\RunOnce\*RD_ via WScript.Shell.RegWrite ... MITRE ATT&CK Mapping Technique ID Usage Modify Registry T1112 COM object persistence, Run keys
MITRE ATT&CK Mapping Technique ID Usage Boot/Logon Autostart Execution T1547 Registry Run keys, Startup shortcuts
The malware... creates a persistence entry by adding a registry entry into “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” for executing the COM DLL.
The malware creates a suspended process for a legitimate file “%appdata%\ProductConfigurations\WINDBVERS.EXE” and resumes its execution after loading the DarkMe RAT malware code using process hollowing.
MITRE ATT&CK Mapping Technique ID Usage Boot/Logon Autostart Execution T1547 Registry Run keys, Startup shortcuts
The malware... creates a persistence entry by adding a registry entry into “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” for executing the COM DLL.
The Visual Basic compiled DarkMe RAT executable is highly obfuscated... The malware keeps the strings encoded, decoding them before use.
6. MITRE ATT&CK Mapping Technique ID Usage Masquerading T1036 AnyDesk disguised as legitimate remote support
MITRE ATT&CK Mapping Technique ID Technique Usage T1036.001 Invalid Code Signature Fake "Microsoft Corporation" and "Microsoft Windows Publisher" certs
[8] Process Masquerading Drops as: RuntimeBroker.exe, ctfmon.exe, dwm.exe, TextInputHost.exe, chrome_update.exe, edge_update.exe, windows_update.exe
The malware creates a suspended process for a legitimate file “%appdata%\ProductConfigurations\WINDBVERS.EXE” and resumes its execution after loading the DarkMe RAT malware code using process hollowing.
Windows Installer (msiexec.exe) extracts files from “oxc.msi” and starts executing the DLL file.
[2] Execution Variants forex.sct -> COM scriptlet via regsvr32 (LOLBin, CLSID FEEDACDC)
Windows Installer (msiexec.exe) extracts files from “oxc.msi” and starts executing the DLL file “AFWIKFNMUI9430.ocx” using rundll32 by calling the exported function “RunDllEntryPointW.”
If the malware is being debugged using the IDA debugger, threat actors will receive the active window name as “IDA” and can avoid further communication with the targeted machine.
DarkMe EXE variants write to HKLM\...\RunOnce\*RD_ via WScript.Shell.RegWrite ... MITRE ATT&CK Mapping Technique ID Usage Modify Registry T1112 COM object persistence, Run keys
MITRE ATT&CK Mapping Technique ID Technique Usage T1553.005 Mark-of-the-Web Bypass WaterHydra CVE-2024-21412 (historical)
MITRE ATT&CK Mapping Technique ID Technique Usage T1056.001 Keylogging Gma.System.MouseKeyHook (QuasarRAT), DarkMe FRIKAT
The malware gets the active window name using the APIs GetForegroundWindow and GetWindowTextA.
The malware retrieves the computer name and username information from the environment variables.
The malware collects various information from the victim’s machine, including... computer name...
If the malware is being debugged using the IDA debugger, threat actors will receive the active window name as “IDA” and can avoid further communication with the targeted machine.
The malware gets the installed antivirus information using Windows Management Instrumentation (WMI) queries... “SELECT * FROM AntivirusProduct”.
To retrieve the country information, the malware uses the API GetLocalInfoA with arguments “LOCALE_SISO3166CTRYNAME” and “LOCALE_SENGLISHCOUNTRYNAME.”
MITRE ATT&CK Mapping Technique ID Technique Usage T1056.001 Keylogging Gma.System.MouseKeyHook (QuasarRAT), DarkMe FRIKAT
MITRE ATT&CK Mapping Technique ID Usage Screen Capture T1113 DarkMe FRIKAT command
MITRE ATT&CK Mapping Technique ID Technique Usage T1560 Archive Collected Data DarkMe ZIPALO command
MITRE ATT&CK Mapping Technique ID Technique Usage T1071.001 Web Protocols GitHub raw content for payload staging
The malware gets the IP address for the decrypted C2 host using the API gethostbyname and uses socket APIs for communicating with the C2 server.
The batch script is responsible for downloading and executing the malicious Microsoft Installer File (MSI).
6. MITRE ATT&CK Mapping Technique ID Usage Remote Access Software T1219 AnyDesk for persistent operator access to C2 infrastructure
6. MITRE ATT&CK Mapping Technique ID Usage Non-Standard Port T1571 AnyDesk on 7070, DarkMe on 4242
The RC4 encrypted C2 address... is decrypted using the RC4 key “noway123!$$#@35@!”.
6. MITRE ATT&CK Mapping Technique ID Usage Encrypted Channel T1573.002 TLS 1.2 on AnyDesk connections
The malware collects and sends system information to the C2 server using the send API from DLL ws2_32.dll.
20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.