DarkMeMalware
Last reported 27 days ago, by Help Net Security5 reports
ATT&CK techniques
6 of 65 · each with the sentence it comes from- T1684Social Engineering
“41% of CISOs reported at least one social engineering incident involving a deepfake during an employee audio call in the past 12 months, according to Gartner.”
- T1036Masquerading
“…ty that allows them to spoof file extensions, which means that they are able to hide the launch of malicious script within an archive masquerading as a ‘.jpg’, ‘.txt’, or any other file format”
- T1055.012Process Hollowing
“T1055.012 Process Injection: Process Hollowing”
- T1059.005Visual Basic
“DarkMe is a Visual Basic 6 (VB6) spy-RAT previously attributed to the financially-motivated APT tracked as Water Hydra and the EvilNum-led Operation DarkCasino.”
- T1547.001Registry Run Keys / Startup Folder
“T1547.001 Registry Run Keys / Startup Folder”
- T1555.005Password Managers
“Encourage the use of password managers for the storage of login data.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents“DarkMe RAT trades zero-days for plain phishing emails”
-
Risky Bulletin: Major vulnerability found in ancient TACACS+ networking protocol“DarkMe RAT: Huntress researchers have documented two recent campaigns spreading DarkMe, a VB6 RAT historically linked to a bunch of e-crime activity.”
-
ThreatsDay: AI Search Poisoning, AI Coding Tool Leaking Repos, One-Click Code Execution and 13 More Stories“DarkMe Returns via Social Engineering”
-
DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer“DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer”
-
Traders’ dollars in danger: CVE-2023-38831 zero-day vulnerability in WinRAR exploited by cybercriminals to target traders“On July 10, 2023, while researching the spread of DarkMe malware the Group-IB Threat Intelligence unit came across a previously unknown vulnerability in the processing of the ZIP file format by WinRAR.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- third-party[.]comin 1 report
- posh[.]vipin 1 report
- onecause[.]comin 1 report
- raiselysite[.]comin 1 report
- adminmenueditor[.]comin 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.