Image: cdn.builder.io · rights & removal

DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer

Reporting by Huntress LabsRead the original at huntress.com

Executive Summary

A multi-stage attack chain involving DarkMe leveraged a novel initial access vector, bypassing traditional exploit delivery by using a seemingly benign file extension (.pif) to deliver an executable masquerading as a program information file. This dropper initiated the process by invoking msiexec to download and execute an MSI installer from an attacker-controlled HTTPS address. The installer contained a custom exemsi wrapper that unpacked files into a temporary directory and executed a staging script. This script further copied components, created a registry template, and invoked rundll32 with a specific GUID to register a COM object. This registration was followed by a chain of three Visual Basic 6 loaders (Coconout.dll, Use.dll, Finalized.dll) that served as an obfuscation layer. These loaders executed sophisticated logic involving process enumeration, registry manipulation, and the hollowing of a legitimate Microsoft binary, clspack.exe. The payload execution involved a custom RC4-like stream cipher for decryption, which revealed a hardcoded C2 domain, and persisted by setting a custom run key that routed execution through explorer.exe, masking the direct invocation of rundll32.

Facts Only

* Malware delivery utilized a file extension named .pif, masquerading as a program information file.
* Initial access involved a link in a social engineering email leading to an image, which delivered an executable disguised as an image.pif.
* The dropper invoked msiexec to download and execute an MSI installer from a remote HTTPS address.
* The MSI used an exemsi wrapper that unpacked files into %AppData%\ComponentsFolder\ and executed a staging script (prnfig.wsf).
* The staging script copied components, created registry templates, and ran rundll32 with a GUID for COM registration.
* Three VB6 loaders (Coconout.dll, Use.dll, Finalized.dll) were used to execute the final stage.
* The loader chain included calls that indicated process enumeration and payload hollowing into clspack.exe.
* Decryption involved a custom RC4 routine utilizing a derived key.
* Persistence was established via a registry value invoking explorer.exe with a custom protocol handler.
* The final payload involved executing code within the hollowed clspack.exe process.
* C2 communication utilized TCP port 7712.

Full Take

The observed tradecraft illustrates an evolution of threat actor methodology where sophisticated zero-day exploits are substituted with less conspicuous initial access techniques, demonstrating a pivot toward high-volume, low-effort delivery. The complexity remains in the final stage—the custom multi-stage loader built on legacy VB6 components and bespoke COM registration—suggesting that even when delivery mechanisms change, the core logic for achieving persistence and execution remains highly customized. This points to an operational maturity where the investment in exotic exploits is traded for adaptability in initial access, allowing campaigns to target a broader audience, from niche financial forums to general corporate users. The use of VB6 artifacts, specific linguistic mnemonics derived from Spanish and Italian, and custom C2 communication over non-standard ports reveal a highly personalized signature that moves beyond generic tooling. This suggests an operator with deep, bespoke knowledge who leverages publicly known vulnerabilities as an entry point but relies on unique internal logic for post-exploitation, indicating that the true indicator of compromise lies not in the exploit itself, but in the predictable sequence of custom operations performed after successful entry.
Bridge Questions: How does the observed reliance on customized VB6 loaders impact the scalability and maintenance of these campaigns? What are the long-term security implications when threat actors favor low-effort delivery over complex exploit chaining? Is the highly specific nature of the C2 artifacts indicative of a single, persistent group or a shifting ecosystem of actors utilizing similar foundational techniques?

From the original · Huntress Labs

Background DarkMe, a Visual Basic 6 (VB6) spy trojan and remote access tool became well known in February 2024 for its use of zero days to deliver malware. But this malware family was first observed in September 2021 and publicly documented a year later by NSFOCUS under "Operation DarkCasino" attributed to a group called EvilNum.

Read the full story at huntress.com

Sentinel — Human

Confidence

This text exhibits high forensic detail typical of expert threat hunting reports, synthesizing raw technical findings into a cohesive narrative about advanced malware tradecraft and resulting mitigation strategies.

Signals Detected

Erratic sentence structure and highly specialized, deep technical jargon interspersed with narrative framing.

Strong internal thematic coherence; the piece successfully transitions from a specific threat history into deep reverse-engineering details and finally to broad strategic implications without sounding purely synthesized.

Structured flow where evidence (Figures 1-21) is integrated directly into the argument, suggesting an investigative structure rather than simple aggregation of talking points.

Extremely high density of specific, multi-layered technical artifacts (specific API calls, registry keys, broken RC4 routines, custom naming conventions) which suggests genuine, hands-on analysis underpinning the narrative.

Human Indicators

The inclusion and detailed deconstruction of non-standard cryptographic implementation (the broken RC4 routine) combined with very specific, low-level artifacts (e.g., .pif files, custom COM registration chains, specific file path manipulations) points strongly toward a human analyst performing deep forensic work.

The use of highly specific, context-dependent terminology and the synthesis of disparate pieces of threat intelligence (from multiple sources referenced implicitly or explicitly) indicates an investigative synthesis rather than general LLM regurgitation.