Loading malware…
DarkRAT is a Windows malware family associated with two distinct but related usages of the name in criminal tooling. One usage refers to a native C++ HTTP-based loader and botnet framework marketed on underground forums as DarkRATv2. In that form, it operates less like a simple loader and more like a modular bot controller, supporting centralized tasking, plugin-based extension, persistence, download-and-execute behavior, software and geographic targeting, and optional modules including stealer, hidden virtual network computing, cryptocurrency mining, and distributed denial-of-service functionality. Reported implementation details include Windows persistence, watchdog-based relaunch, antivirus discovery through WMI, mutex-based single-instance control, process hollowing, and multiple anti-debugging and error-suppression measures. Analysis has also linked this branch to code and design reuse from AbSent-Loader, LiteHTTP, and hCrypt, and source leakage or resale likely enabled downstream reuse and repackaging by other actors.
A second usage of the name appears in the AsyncRAT lineage, where DarkRAT is identified as a ShaShenRAT fork descending from DCRAT, itself a major descendant of AsyncRAT. In that context, DarkRAT is part of a broader ecosystem of Windows remote access malware whose operators and builders often inherit recognizable certificate metadata patterns from parent projects. This lineage places DarkRAT alongside other DCRAT-derived families such as VenomRAT, EchoRAT, Gh0stRAT, BitRAT, CyberSpike, and Dumpling RAT.
Across the available reporting, DarkRAT is therefore best understood as Windows malware used for remote control and post-compromise operations, with capabilities spanning persistence, defense evasion, process injection via hollowing, reconnaissance of local security products, and extensible follow-on activity through plugins or secondary modules. The name has been used both for a native HTTP botnet/loader framework and for a DCRAT-lineage RAT variant, so attribution and classification should be made carefully in context.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
API: RegSetValueExA Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WinSystem32 Value: C:\Users\user\AppData\Roaming\Microsoft\Windows\00jXHoowyD.exe ... void addstartup () ... RegSetValueEx ( newValue , "System32" ... ) | Examples Command: cmd.exe /k start %APPDATA%\Microsoft\Windows\00jXHoowyD.vbs ... The vbs file provides periodic checks to ascertain whether the process is running in the background or not.
CreateProcessA - dwCreationFlags 4 - CREATE_SUSPENDED ... NtUnmapViewofSection ... VirtualAllocEx WriteProcessMemory SetThreadContext ResumeThread ... This method is known as process hollowing.
API: RegSetValueExA Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WinSystem32 Value: C:\Users\user\AppData\Roaming\Microsoft\Windows\00jXHoowyD.exe ... void addstartup () ... RegSetValueEx ( newValue , "System32" ... ) | Examples Command: cmd.exe /k start %APPDATA%\Microsoft\Windows\00jXHoowyD.vbs ... The vbs file provides periodic checks to ascertain whether the process is running in the background or not.
Tries to be shady by calling itself WinSystem32. The Run key points to the following location on the file system... Installed hidden on the FileSystem \AppData\Roaming\Microsoft\Windows\00jXHoowyD.exe or \AppData\Roaming\WinBootSystem\WinBootSystem.exe
CreateProcessA - dwCreationFlags 4 - CREATE_SUSPENDED ... NtUnmapViewofSection ... VirtualAllocEx WriteProcessMemory SetThreadContext ResumeThread ... This method is known as process hollowing.
cmd.exe /C ping 127.0.0.1 -n 1 -w 3000 > Nul & Del /f /q "%s" ... void uninstall () ... "PING.EXE -n 5 127.0.0.1 && del " + ExePath ()
API: CreateMutexA Value: Local\3mCUq1z ... If the mutex already exists, it won't re-infect the system.
wmi with WQL Select * From AntiVirusProduct via root\SecurityCenter2 ... object -> Get ( L"displayName" ... ) ... C2 beacon parameters ... installedRam ... netFramework2 ... netFramework4 ... cpuName ... operingsystem
Threat hunters often focus on spotting command-and-control (C2) servers, open directories typically identified by the phrase “Index of” and phishing components.
Darkrat is designed as a HTTP loader... This HTTP loader - in reality - acts more like a bot controller... #2 Bot check-in request POST /request HTTP/1.1 ... request=... Initially the C2 server address is hidden... There's a pastebin link in plain text embedded in the sample... the plain-text is the C2 address
104 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named RAT variant in the AsyncRAT/DCRAT family lineage, noted as deriving via ShaShenRAT.
A DCRAT-lineage RAT variant descended via ShaShenRAT and tracked primarily through issuer organization certificate metadata.
Likely a remote access trojan listed as detectable via SHA-256 hash.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.