DarkMe RAT Campaign Uses Phishing and MSI Loaders to Deploy VB6 Infostealer
A new DarkMe remote-access Trojan campaign has shifted from the exploit-led delivery associated with Water Hydra to straightforward phishing. Lures disguised as image links served executable .PIF files, which launched a remote MSI installer and a multistage Visual Basic 6 loader chain. The chain registers a COM object and invokes it through rundll32.exe /sta {CLSID}, checks for sandbox-like processes, creates persistence through a custom Locked:// URI handler, and process-hollows the signed Microsoft clspack.exe binary. The final payload combines remote-access and infostealing functions: it can collect cryptocurrency-wallet data, take screenshots, enumerate installed antivirus products, manipulate files, and run commands. It communicates over custom TCP command-and-control on port 7712; observed infrastructure included thatawful[.]boutique resolving to 67.43.50[.]11:7712. Organizations should block the identified infrastructure, investigate .PIF downloads and suspicious remote MSI execution, and hunt for the rundll32.exe /sta COM-launch pattern and unauthorized Locked:// registry protocol handlers.. Fonte: https://mallory.ai/stories/01a0cd53-1e0c-7b0c-b5de-b987c058dc3c
Itagora tiene in archivio titolo e sommario per la ricerca interna. Il testo completo resta sulla fonte. Il link in uscita non invia referrer.