BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details

DarkCloud

88
Global rank
62 infographic chevron month
Month rank
51 infographic chevron week
Week rank
0
IOCs

DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails.

Stealer
Type
Unknown
Origin
1 November, 2022
First seen
10 September, 2024
Last seen

How to analyze DarkCloud with ANY.RUN

Type
Unknown
Origin
1 November, 2022
First seen
10 September, 2024
Last seen

IOCs

IP addresses
103.14.121.180
184.170.144.21
167.99.35.88
198.38.82.23
181.214.142.230
Hashes
5a1e4d4b7b9c90d311b5944f78ab8807f6c982441cc987d0d0aa0d5ccd13d5fe
e43d1424c912e7c255bba16e116d51d856c4c2c5ea103fe5ea21f6077e72c9c2
c05fbef6ef68934b1381cf48a956981ea7e1bc4969ca97c8d9851c0309e4538f
2f26dac5e15dffd33c32b804e298148572627165cbf983a727a7ff0ad20ba571
b2347e804c9462b266fcd04d68ffb143cf0b1781917cc0477ea4e7af18bb7d81
3ae8e5fa3663e5a029211030180d17ed9e4b6f70bc2fd3cc54c7108b2b59c6a8
aa5c1f95c403a035f8eebcc9c23b7421633d41e0a254ad859173a3763bc7d433
0b7362f05fccfc83b6dc915e876ae678d98ec90297ead4f53106186c2ea60de0
571cc0498824bbf035b1291c9dc08726c93a943411a21659916d2ed27e6fa3f0
081d698ce05d76d8762d9f725143095a0c3ee39a663c08e4523e951dfab93507
88e5b0195785890d324ec49f11d0fcfd1f33c0b61d364825e6bb04831abc7fbf
7f2d28ddc7331f9aa4eef46e5ff073371d406d43a21cee7b8137255533042e3f
79c4777d731a557a998595e55385c43b6e656bbe6f258a86119680228d04db9e
0779a231908c8dc57f689ba1a3290da1b2418116140065dc420c21a90959d3fb
42ef434d4f2fbb1d7dcc088b49c7fd18b15a5cc6871d3b03126071f2981de33f
500546314c612ba53f7c5ba4a2a48fefc627f967d885628887a39b253ca84ea2
f37044c7d35e640b023f3cdc034ad89cdd077a2e8967a9e62f887296faa57a93
24cb9c0652c45e8ec505eef2010ef2360b98aea4b7d5d204793e90c0d63f4d4d
2a1bfb2d892abc77ef98479e6f211f72a76b7a4f329aa7349b3f5118c66f5f2f
6923fdc205daf214ddfdcfc83f398da7646f48d4c3e432b7df373a2d2f5ba1ba
Domains
ns3.colofreed.pl
ns1.rigreo.at
ns2.fircitris.at
ns2.loklordg.at
ns3.regioklous.at
ns1.flyopenvz.ru
ns4.esriolter.at
ns4.neongit.at
ns4.koncaved.ru
turkeyhotelnoslafas.su
itemsuofitquestumequequi.com
jgworldupd.com
petroilimos.su
alefistacorm.ru
arloeiffg.com
rastobona.com
red-stoneses.com
finley.su
lochjol.com
searscanada.su
URLs
https://api.telegram.org/bot6201772437:AAE8z2HCV4dlViF8O7_bVozdyvuR6EkBCPA/sendMessage
https://api.telegram.org/bot5723230539:AAHXr6rmQsEsq1CdwKBxLF-mnANEsBE4mYk/sendMessage
https://api.telegram.org/bot6686872771:AAGUwkUh0LMB8XwZ6Sv6jR4DHAsdZafImc0/sendMessage
https://api.telegram.org/bot6843160964:AAF3CXe6SpPYlr6PSxsfXFuMMbuXMIkkNtE/sendMessage
https://api.telegram.org/bot7151528784:AAFbcms5s5mObSYwvv7y4FgZaar6LzjX7NE/sendMessage
https://api.telegram.org/bot6062190835:AAFarBYBv-mQ3aLxNEnTAnblGK2thSsO8vQ/sendMessage
https://api.telegram.org/bot6800672014:AAFjIhthNxpYeDLxh4u9CJvqMfisOhMGH6M/sendMessage
https://api.telegram.org/bot6107929879:AAHV6JwXs7rcYzMGLe3_opR5_gdKAC16Ye4/sendMessage
https://api.telegram.org/bot7148308455:AAGrdlRzhjt8mx31-dFYXt4kvhbFnphSlSg/sendMessage
https://api.telegram.org/bot7070490418:AAFJ-COsGzz3b8scJZVCXnt58-J1srUH5DQ/sendMessage
https://api.telegram.org/bot6771461481:AAH7vQEIoBDQr43Dx_zORT5cGMl9_tDt0L8/sendMessage
https://api.telegram.org/bot6361371678:AAH7b9uIkhwP1TBt8t78VwxXD7LXjsOcbYk /sendMessage
https://api.telegram.org/bot6746383234:AAHJ0bggxpanHasWvjMSekrXd1f03jgHZUM/sendMessage
https://api.telegram.org/bot6946449919:AAGrwsEUPXNuNb2IKsVchu8VgWMNPhHYEN8/sendMessage
https://api.telegram.org/bot6363864044:AAEOHd3rwToTFkGX2VcAe8RqOT15foqZ6jY/sendMessage
https://api.telegram.org/bot6361371678:AAH7b9uIkhwP1TBt8t78VwxXD7LXjsOcbYk/sendMessage
https://api.telegram.org/bot6361371678:AAH7b9uIkhwP1TBt8t78VwxXD7LXjOcbYk/sendMessage
https://api.telegram.org/bot5881209387:AAEYbMO86ewxRCF0hqbguD3F2NjXIQs4EJU/sendMessage
https://api.telegram.org/bot5637864859:AAHatMmLjO3i5zaPb5Ppy5_wDiRtKwQUbSU/sendMessage
https://api.telegram.org/bot6028253602:AAFFbacUfiOxmvzuo36D6g83Flf23bpPXYA/sendMessage
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 314
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 363
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1160
comments 0

What is DarkCloud malware?

DarkCloud is a stealer malware written in Visual Basic. The core functionality of the malicious software is collecting and exfiltrating sensitive information from infected machines. The type of data stolen by DarkCloud ranges from user credentials to credit card details in browsers.

The malware has been active since the end of 2022 and has been widely used in attacks in 2023. DarkCloud is sold by its creators on DarkNet forums who also provide customization options, including the additional clipper module, allowing the malware to monitor the content saved by victims to the clipboard.

The most common infection chain for DarkCloud is spam emails, targeting a variety of users. The malware is usually distributed in the form of a malicious attachment. Once downloaded and launched by the user, the malware gets installed on the device and begins its malicious activities.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Technical details of the DarkCloud malicious software

DarkCloud can engage in the following operations on the infected system:

  • Steal information: It can pull data from different browsers and FTP clients, as well as the clipboard.
  • Capture screenshots: DarkCloud can take screenshots of the user’s activities.
  • Record keystrokes: The malware has the keylogging capability, letting it keep track of everything typed on the keyboard by the victim.
  • Exfiltrate files: It is capable of grabbing files of different formats, such as .txt, .rtf, and .pdf.
  • Communicate with the C2: DarkCloud supports several communication protocols, including SMTP and via Telegram, used for relaying stolen data to the attacker.

Additionally, similar to LaplasClipper, DarkCloud is equipped with a crypto swapper, enabling it to replace the user’s crypto wallet addresses with those of the attacker.

The malware can create a Task Scheduler entry in order to gain persistence on the system.

Execution process of DarkCloud

In order to examine the entire execution chain of DarkCloud in more detail, we can upload its sample to the ANY.RUN sandbox.

As stealers strive to conceal their activities, the DarkCloud stealer employs a deliberately straightforward execution chain to minimize visibility. Consequently, the infected operating system experiences a limited number of processes, and the malware refrains from utilizing system tools. Once the payload infiltrates the compromised system, it promptly initiates its execution.

The analyzed sample injects the system binary "AppLaunch" and subsequently executes it. After initiating, DarkCloud employs time-based evasion techniques in an attempt to conceal itself from sandboxes. However, it was detected, and the configuration was successfully extracted. It then starts a process executing all malicious activities, encompassing data theft and communication with the Command and Control (C&C) server.

DarkCloud process graph shown in ANY.RUN DarkCloud's process graph demonstrated in ANY.RUN

Distribution methods of the DarkCloud malware

Just like in the case of other stealer malware, such as Formbook and Lokibot, the most common way used by attackers to distribute DarkCloud is via emails. In most cases, criminals employ social engineering and craft their messages to look legitimate. This is why victims often receive fake invoice payment requests and similar emails with files attached to them. Users who fail to recognize a scam end up downloading the malicious attachment and running it on their system, thus triggering the infection process.

Conclusion

In order to avoid falling victim to DarkCloud, it is vital to follow strict security practices. One of them is analyzing suspicious files and links in a malware sandbox. ANY.RUN is a cloud-based service that lets you investigate any email attachment or URL sent to you by an unknown sender and determine whether it poses any risk.

ANY.RUN’s interactive approach to malware analysis enables you to engage with the files and the system just like on your own computer, performing all the necessary actions to execute malicious software fully. The service provides you with comprehensive threat reports that contain details about the attack, indicators of compromise (IOCs), and other relevant information.

Try ANY.RUN for free – request a demo!

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More