Loading malware…
DarkCloud is a Windows information-stealing malware family first observed in 2022 and commonly sold as a low-cost commodity stealer through criminal marketplaces and Telegram. It is typically implemented in Visual Basic 6 and has appeared in multiple versions, including a rewritten v4.2 variant. DarkCloud is primarily used to harvest credentials and other sensitive data from infected systems, targeting web browsers, email clients, FTP clients, communication tools, and cryptocurrency-wallet-related data.
DarkCloud’s collection scope includes saved browser usernames and passwords, cookies, credit card and other browser-stored financial data, email client information and contacts, FTP credentials, screenshots, keystrokes, clipboard contents, documents, and system information. Reported targets include Chromium-based browsers, Firefox-based browsers, Outlook, Thunderbird, FoxMail, FileZilla, CoreFTP, WinSCP, and other locally stored application data sources. Some variants use bundled SQLite-related components to access browser credential databases and may query browser data stores directly to extract login and payment information.
The malware is most often delivered through phishing and spam campaigns using compressed attachments and lures themed as invoices, quotes, payment statements, shipment notices, or financial correspondence. Observed infection chains also include JavaScript, PowerShell, JAR, BAT, VBS, AutoIt, and .NET-based loaders, as well as multi-stage delivery using steganography or embedded payloads. DarkCloud has also been reported in campaigns involving malvertising, watering-hole activity, infected websites, and cracked-software-style lures, though phishing remains the most consistently documented vector. It is frequently delivered by intermediary loaders and crypter-like chains, and has been observed alongside other malware families such as ClipBanker, Agent Tesla, AsyncRAT, Remcos, XWorm, SmokeLoader, and payloads delivered by PhantomVAI/PanthomVAI-style loaders.
Execution and persistence behavior varies by campaign and version. Documented techniques include copying itself into user-accessible directories, establishing autorun through Run or RunOnce mechanisms, creating Startup-folder scripts, and scheduled-task persistence. Several campaigns used process hollowing or process injection into legitimate Windows processes such as MSBuild or svchost to execute the final stealer while reducing visibility. Anti-analysis and defense-evasion features include heavy string obfuscation or encryption, staged decryption, runtime loading, checks for analysis tools, and in some cases delaying activity until keyboard or mouse interaction is detected.
Exfiltration is flexible and commonly uses multiple simultaneous channels. Reported methods include SMTP email, Telegram bot communications, FTP upload, HTTP POST, and PHP-based web panels. This multi-channel design improves resilience when one exfiltration path is blocked. DarkCloud has been used in campaigns targeting both individuals and enterprises, with manufacturing among the specifically reported victim sectors. As a commodity infostealer with broad credential and data theft capability, DarkCloud can support follow-on intrusion activity including account compromise, fraud, phishing, and broader post-compromise operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Examples of Different Persistence Methods schtasks.exe /Create /TN "Updates\<RandName>" /XML "C:\Users\<user>\AppData\Local\Temp\<DroppedFile>"
Some of these can be scripts, covering a wide range of formats, from JAR and BAT to PowerShell (PS).
MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution Command and Scripting: AutoIt T1059.010 AutoIt-compiled loader with WRSJLIM cipher
Once we reach this stage, what we obtain in most cases is a library that loads the code into memory.
Examples of Different Persistence Methods schtasks.exe /Create /TN "Updates\<RandName>" /XML "C:\Users\<user>\AppData\Local\Temp\<DroppedFile>"
After multiple and varied obfuscation techniques for each type, the process leads either to a download or to the extraction of a binary.
Among these, there are many similar samples, often utilizing different obfuscators.
[TA0005][T1036] Duplication of original files or loaders in temporary paths
Ultimately, everything culminates in the injection of a VB-based binary, which is the Stealer. This gets injected into a process of its choosing.
MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Indicator Removal: File Deletion T1070.004 Self-deletion via cmd /C @RD /S /Q
The final step is the theft of various types of information, including browser data, FTP credentials, screenshots, keylogging, and more.
DarkCloud steals the account credentials of users that have been saved on web browsers, FTP, and email clients.
Once injected, DarkCloud exhibits a wide range of malicious activities. It systematically gathers information from web browsers, collects system data, and even harvests credit card details.
[TA00011][T1071] Connection via noncommon process to TG bots ... https?:\/\/api\.telegram\.org\/bot\d+:[A-Za-z0-9_-]+\/
Like the average Infostealer, DarkCloud steals the account credentials of users that have been saved on web browsers, FTP, and email clients. It is also similar to other Infostealers like AgentTesla and SnakeKeylogger as it uses SMTP or the Telegram API to send the collected information to the C&C server.
103 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An infostealer observed in phishing emails impersonating an electronics components manufacturer; it used compressed attachments containing executables and exfiltrated data over SMTP.
DarkCloud3
Infostealer distributed via email that collects documents, keystrokes, email client data, browser data, screenshots, and cryptocurrency wallet information.
Named as one of the malware families previously delivered by the PanthomVAI loader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.