MalwareUsed by 3 actorsExploits 2 CVEs

DarkMe RAT

DarkMe RAT is a Windows-focused Visual Basic 6 remote-access trojan associated with the Water Hydra, also known as DarkCasino, threat activity. Campaign activity surged in February 2024 and exploited CVE-2024-21412. Observed execution chains use a shortcut-based lure, remotely retrieved scripts and installer components, COM registration, layered decryption, and process hollowing to launch the final obfuscated payload. DarkMe establishes persistence through COM registration and a current-user Run entry. It collects host and user identifiers, victim country, installed antivirus products, and foreground-window titles, then transmits collected information to its command-and-control infrastructure over socket-based communications. The implant supports asynchronous command execution, including shell execution, file and directory operations, directory enumeration, archive creation, and system reconnaissance. DarkMe uses encoded strings, garbage code, control-flow obfuscation, and process hollowing to hinder analysis and detection.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

2 CVES

CVE-2024-21412Microsoft Windows Internet Shortcut SmartScreen BypassExploited in the wild

A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day (CVE-2024-21412) by the hacking group Water Hydra. | A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day CVE-2024-21412 by the hacking group Water Hydra.

via sonicwallsonicwall.com

CVE-2023-38831Arbitrary code execution in WinRAR archive file handling

DarkMe RAT is the signature malware of the WaterHydra/DarkCasino APT group. Seven DarkMe samples were found sharing the same C2 IP as the QuasarRAT deployment. DarkMe is a custom VB6 RAT with reversed UTF-16LE command strings, a SOCKET_WINDOW class for asynchronous C2 communication, and a command set including shell execution (SHLEXE), file operations, directory mapping, ZIP archive creation, and system reconnaissance.

via breakglass intelintel.breakglass.tech

THREAT ACTORS

Groups observed using it

3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Water Hydra

A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day CVE-2024-21412 by the hacking group Water Hydra.

via sonicwallsonicwall.com

Evilnum

via breakglass intelintel.breakglass.tech

DarkCasino

via breakglass intelintel.breakglass.tech

MITRE ATT&CK

Techniques & procedures

36 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence2

MITRE ATT&CK Mapping Technique ID Usage Spearphishing Link T1566.002 Forex forum posts, Telegram trading channels

Execution

6 techniques

T1059.001PowerShellEvidence1

MITRE ATT&CK Mapping Technique ID Technique Usage T1059.001 PowerShell Multi-stage PS1 loaders with AMSI bypass

T1059.003Windows Command ShellEvidence1

A URL-hosted batch script downloads the MSI file into the %temp% folder and starts its execution.

T1059.005Visual BasicEvidence1

MITRE ATT&CK Mapping Technique ID Technique Usage T1059.005 Visual Basic DarkMe VB6 RAT, forex.sct COM scriptlet

T1203Exploitation for Client ExecutionEvidence2

A spike in distributing DarkMe RAT was observed in February 2024, exploiting the zero-day (CVE-2024-21412) by the hacking group Water Hydra.

T1204.002Malicious FileEvidence3

Execution of DarkMe RAT starts from a Windows Shortcut File (LNK)... The Windows Shortcut File (LNK) displays an image related to a stock trading graph to distract the user while a malicious batch script from a URL is executed in the background.

T1559.001Component Object ModelEvidence1

The “info.txt” file contains registry entries to register the COM DLL “soundtrack.ocx” with CLSID “AAE802DB-FB67-4407-A175-61223EFF30D4.” The registered COM DLL is executed by “rundll32” with the CLSID.

Persistence

3 techniques

T1112Modify RegistryEvidence1

DarkMe EXE variants write to HKLM\...\RunOnce\*RD_ via WScript.Shell.RegWrite ... MITRE ATT&CK Mapping Technique ID Usage Modify Registry T1112 COM object persistence, Run keys

T1547Boot or Logon Autostart ExecutionEvidence1

MITRE ATT&CK Mapping Technique ID Usage Boot/Logon Autostart Execution T1547 Registry Run keys, Startup shortcuts

T1547.001Registry Run Keys / Startup FolderEvidence2

The malware... creates a persistence entry by adding a registry entry into “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” for executing the COM DLL.

Privilege Escalation

3 techniques

T1055.012Process HollowingEvidence1

The malware creates a suspended process for a legitimate file “%appdata%\ProductConfigurations\WINDBVERS.EXE” and resumes its execution after loading the DarkMe RAT malware code using process hollowing.

T1547Boot or Logon Autostart ExecutionEvidence1

MITRE ATT&CK Mapping Technique ID Usage Boot/Logon Autostart Execution T1547 Registry Run keys, Startup shortcuts

T1547.001Registry Run Keys / Startup FolderEvidence2

The malware... creates a persistence entry by adding a registry entry into “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” for executing the COM DLL.

Stealth

9 techniques

T1027Obfuscated Files or InformationEvidence3

The Visual Basic compiled DarkMe RAT executable is highly obfuscated... The malware keeps the strings encoded, decoding them before use.

T1036MasqueradingEvidence1

6. MITRE ATT&CK Mapping Technique ID Usage Masquerading T1036 AnyDesk disguised as legitimate remote support

T1036.001Invalid Code SignatureEvidence2

MITRE ATT&CK Mapping Technique ID Technique Usage T1036.001 Invalid Code Signature Fake "Microsoft Corporation" and "Microsoft Windows Publisher" certs

T1036.005Match Legitimate Resource Name or LocationEvidence1

[8] Process Masquerading Drops as: RuntimeBroker.exe, ctfmon.exe, dwm.exe, TextInputHost.exe, chrome_update.exe, edge_update.exe, windows_update.exe

T1055.012Process HollowingEvidence1

T1218.007MsiexecEvidence1

Windows Installer (msiexec.exe) extracts files from “oxc.msi” and starts executing the DLL file.

T1218.010Regsvr32Evidence1

[2] Execution Variants forex.sct -> COM scriptlet via regsvr32 (LOLBin, CLSID FEEDACDC)

T1218.011Rundll32Evidence3

Windows Installer (msiexec.exe) extracts files from “oxc.msi” and starts executing the DLL file “AFWIKFNMUI9430.ocx” using rundll32 by calling the exported function “RunDllEntryPointW.”

T1497.001System ChecksEvidence1

If the malware is being debugged using the IDA debugger, threat actors will receive the active window name as “IDA” and can avoid further communication with the targeted machine.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

DarkMe EXE variants write to HKLM\...\RunOnce\*RD_ via WScript.Shell.RegWrite ... MITRE ATT&CK Mapping Technique ID Usage Modify Registry T1112 COM object persistence, Run keys

T1553.005Mark-of-the-Web BypassEvidence1

MITRE ATT&CK Mapping Technique ID Technique Usage T1553.005 Mark-of-the-Web Bypass WaterHydra CVE-2024-21412 (historical)

Credential Access

1 technique

T1056.001KeyloggingEvidence1

MITRE ATT&CK Mapping Technique ID Technique Usage T1056.001 Keylogging Gma.System.MouseKeyHook (QuasarRAT), DarkMe FRIKAT

Discovery

6 techniques

T1010Application Window DiscoveryEvidence1

The malware gets the active window name using the APIs GetForegroundWindow and GetWindowTextA.

T1033System Owner/User DiscoveryEvidence1

The malware retrieves the computer name and username information from the environment variables.

T1082System Information DiscoveryEvidence1

The malware collects various information from the victim’s machine, including... computer name...

T1497.001System ChecksEvidence1

If the malware is being debugged using the IDA debugger, threat actors will receive the active window name as “IDA” and can avoid further communication with the targeted machine.

T1518.001Security Software DiscoveryEvidence1

The malware gets the installed antivirus information using Windows Management Instrumentation (WMI) queries... “SELECT * FROM AntivirusProduct”.

T1614.001System Language DiscoveryEvidence1

To retrieve the country information, the malware uses the API GetLocalInfoA with arguments “LOCALE_SISO3166CTRYNAME” and “LOCALE_SENGLISHCOUNTRYNAME.”

Collection

3 techniques

T1056.001KeyloggingEvidence1

MITRE ATT&CK Mapping Technique ID Technique Usage T1056.001 Keylogging Gma.System.MouseKeyHook (QuasarRAT), DarkMe FRIKAT

T1113Screen CaptureEvidence2

MITRE ATT&CK Mapping Technique ID Usage Screen Capture T1113 DarkMe FRIKAT command

T1560Archive Collected DataEvidence2

MITRE ATT&CK Mapping Technique ID Technique Usage T1560 Archive Collected Data DarkMe ZIPALO command

Command and Control

7 techniques

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK Mapping Technique ID Technique Usage T1071.001 Web Protocols GitHub raw content for payload staging

T1095Non-Application Layer ProtocolEvidence1

The malware gets the IP address for the decrypted C2 host using the API gethostbyname and uses socket APIs for communicating with the C2 server.

T1105Ingress Tool TransferEvidence3

The batch script is responsible for downloading and executing the malicious Microsoft Installer File (MSI).

T1219Remote Access ToolsEvidence1

6. MITRE ATT&CK Mapping Technique ID Usage Remote Access Software T1219 AnyDesk for persistent operator access to C2 infrastructure

T1571Non-Standard PortEvidence1

6. MITRE ATT&CK Mapping Technique ID Usage Non-Standard Port T1571 AnyDesk on 7070, DarkMe on 4242

T1573.001Symmetric CryptographyEvidence1

The RC4 encrypted C2 address... is decrypted using the RC4 key “noway123!$$#@35@!”.

T1573.002Asymmetric CryptographyEvidence1

6. MITRE ATT&CK Mapping Technique ID Usage Encrypted Channel T1573.002 TLS 1.2 on AnyDesk connections

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The malware collects and sends system information to the C2 server using the send API from DLL ws2_32.dll.

INDICATORS OF COMPROMISE

IOCs tracked for this family

20 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

9 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

11 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

ip.v4●●●●●●●●●●●●View more in app7 months ago

hash.sha256●●●●●●●●●●●●View more in app7 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

breakglass intelNews

Mar 7, 2026

AnyDesk as a Management Plane: How a RAT Operator Backdoors Their Own C2 Infrastructure - Breakglass Intelligence - Breakglass Intelligence

Remote access trojan with C2 infrastructure observed on port 4242; the report describes AnyDesk being used by the operator to manage Windows servers hosting DarkMe RAT C2 components.

breakglass intelNews

Mar 7, 2026

Multi-RAT Operation Dismantled: WaterHydra APT Nexus, Five AES Keys Recovered, and Live C2 Infrastructure Mapped Across Three Continents - Breakglass Intelligence - Breakglass Intelligence

A custom VB6 remote access trojan associated with WaterHydra/DarkCasino. It provides shell execution, file operations, directory mapping, ZIP archive creation, reconnaissance, screenshot capability, and keylogging.

sonicwallNews

Jun 27, 2024

A Deep Dive Into DarkME Rat Malware

An obfuscated Visual Basic remote-access trojan delivered through an LNK/MSI/COM-DLL execution chain. It establishes Run-key persistence, performs process hollowing, collects host, user, antivirus, country, and active-window information, exfiltrates it to an RC4-protected C2 server, and accepts asynchronous C2 commands.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching20

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution3

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities2

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping36

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

DarkMe RAT