DarkMe RAT (VB6 Spy-RAT) — Water Hydra / Operation DarkCasino

DarkMe is a Visual Basic 6 (VB6) spy-RAT attributed to the financially-motivated APT tracked as Water Hydra (a.k.a. the EvilNum-led Operation DarkCasino, first documented by NSFOCUS in September 2022). Huntress observed the malware in two separate incidents on 2026-08-31, and the notable shift is delivery: Water Hydra previously burned two zero-days to deliver DarkMe — the WinRAR extension-spoofing flaw (CVE-2023-38831, weaponized April 2023) and the Windows Defender SmartScreen bypass (CVE-2024-21412, weaponized late 2023/early 2024) — but this campaign uses neither. The infection now starts with a plain phishing email linking to what looks like a PNG; the click downloads image.pif, a Windows PE that modern Windows will execute on sight regardless of icon or claimed extension.

The attacker's objective is the same as it has always been: get the VB6 loader chain (Coconout.dll → Use.dll → Finalized.dll) onto the host, pass an inverted 329-application sandbox check ("does a real person use this machine"), establish triple persistence (COM CLSID hijack, custom protocol handler, Run key), and process-hollow the DarkMe payload into a legitimate signed Microsoft binary (clspack.exe) before beaconing to an RC4-obscured C2 for crypto-wallet theft, screenshots, and arbitrary command execution.

The highest-value defensive angle is not the phishing lure — it is the deterministic, low-noise execution chain behind it. rundll32.exe /sta {GUID} with no DLL path, reg.exe import of a .txt file, and a signed Microsoft utility running from %AppData% are all patterns Huntress independently rates as "rare in legitimate use" and that this pack turns into standing detections (§8).

Defender priority: every atomic indicator in this pack (hashes, domains, C2 IP) is corroborated by exactly one public source (Huntress) as of 2026-09-28. Per this pack's evidentiary bar, nothing here is promoted to a blocking/prevent posture — treat §10's Falcon IOC CSV as detect-only and lean on the behavioral queries in §8, which do not depend on this campaign's specific infrastructure staying static.

Tier definitions: T1 vendor/primary-discoverer research; T2 reputable security press / MDR vendor blog; T3 aggregator or threat-briefing digest.

Prompt-injection check: none of the fetched pages contained instructions directed at the research agent (no embedded directives to run commands, fetch alternate "real" IOC sources, or alter these instructions). All fetched content was treated as data.

Hunt hypotheses (ordered by fidelity)

Attack chain

Every row below is sourced to exactly one public reporter (Huntress, 2026-09-22). Per this pack's prevent-posture rule, Action = detect/hunt only for all atomic indicators — none are promoted to a blocking posture. clspack.exe is listed for context; it is a legitimate Microsoft-signed binary and must never be blocked or treated as malicious in isolation.

Checks that do not depend on Falcon CQL — use where Sysmon, Windows auditing, or mail-gateway logs are the only telemetry available, or to cross-validate a Falcon hit.

Sysmon

• Event ID 1 (Process Create): Image ends in .pif; or Image ends in msiexec.exe and CommandLine contains /i http; or Image ends in wscript.exe/cscript.exe and CommandLine contains .wsf and AppData; or Image ends in reg.exe and CommandLine contains import and .txt; or Image ends in rundll32.exe and CommandLine matches /sta {GUID} with no DLL argument.
• Event ID 11 (File Create): TargetFilename under \AppData\Roaming\ComponentsFolder\, or any .pif creation outside a legacy line-of-business share.
• Event ID 12/13/14 (Registry): TargetObject containing CLSID\{CFDC57BA-1705-45AF-BA10-EFC3D592982B}, Classes\Locked\shell\open\command, or a new value under ...\CurrentVersion\Run whose data starts with explorer.exe " followed by a non-http URI scheme.
• Event ID 22 (DNS Query): QueryName = thatawful.boutique.
• Event ID 3 (Network Connect): DestinationIp = 67.43.50.11 and/or DestinationPort = 7712.

Windows Security auditing

• Event ID 4688 (process creation, with command-line auditing enabled via Include command line in process creation events GPO) as a fallback for the Sysmon process rules above on hosts without Sysmon.
• Event ID 4657 (registry value modified, requires SACL on the relevant hive) for the CLSID/protocol-handler/Run-key writes, if Advanced Audit Policy > Object Access > Registry is enabled with the appropriate SACLs (see §13 Step 5).
• Zone.Identifier alternate data stream on image.pif (Mark-of-the-Web) confirms the file arrived from the internet/email rather than being locally built — useful corroboration during triage even though Falcon does not surface ADS contents directly.

Mail gateway / SEG

• Alert on inbound mail containing links whose display text or anchor implies an image (.png/.jpg extension, "photo", "scan") but whose true-file-type detonation returns a PE or .pif.
• Alert on, or retroactively hunt for, delivery to readonline365.com, storageonline.me, viewdocument.live, advancedfuturetechnology.com, or sharedfuturetech.com in URL-click/proxy logs (single-sourced — treat as monitor-and-triage, not an automatic block; see §10).

Promote to a Custom IOA (blocking or high-priority alerting rule, as your policy allows) once each has run FP-clean over the §11 baseline window:

Q3, Q4, Q5, Q8, Q9, Q11, Q12, Q14 stay as scheduled hunt/investigate queries: each carries a real (medium, or context-dependent) false-positive population that needs environment-specific tuning before it is safe to alert on unattended.

All rows below are single-sourced (Huntress, 2026-09-22). None are shipped at action=prevent — see the prevent-posture rule in §4/§12. clspack.exe appears only as documented context; never import it as a blockable indicator.

type,value,action,severity,expiration,description,tags
sha256,394c93dfbb7581c66a23c52b20cd90b31415c0825a2eab7107e60ee3fe693c04,detect,critical,2027-03-28,DarkMe image.pif initial dropper (PE masquerading as an image),campaign:DarkMe
sha256,9fb5888f9ac99227a35f3e08ca08bfb9eed676e1f91638599eba0d7a5aac847f,detect,high,2027-03-28,DarkMe propi.msi staging installer,campaign:DarkMe
sha256,1c923c685f97e556f241d0f1880283500a61dc7ecae8cafe75f34c720ff6b918,detect,high,2027-03-28,DarkMe prnfig.wsf staging script,campaign:DarkMe
sha256,52b242047a8055c0936b384b952c1c16c1072a590610140b01f4acefa8ae883a,detect,medium,2027-03-28,DarkMe filetext2.txt COM registry import,campaign:DarkMe
sha256,4a18f65ab7de7be385cbcebc78c9ae49334294f93726822b8900f9b7a324a6b0,detect,critical,2027-03-28,DarkMe Coconout.dll loader stage 1 (COM entry point),campaign:DarkMe
sha256,3052352ac811c48590f0239281312c35560fc06b4dc39790e365eb1e7cab8634,detect,critical,2027-03-28,DarkMe Use.dll loader stage 2 (anti-sandbox gate plus persistence),campaign:DarkMe
sha256,d7185bd7b450b478c793ece3025bdd867eed70bb7b739a5f26375b5ba6cf0d93,detect,critical,2027-03-28,DarkMe Finalized.dll loader stage 3 (RunPE),campaign:DarkMe
sha256,54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76,detect,high,2027-03-28,DarkMe company.cer encrypted payload,campaign:DarkMe
domain,readonline365.com,detect,high,2027-03-28,DarkMe phishing delivery host,campaign:DarkMe
domain,storageonline.me,detect,high,2027-03-28,DarkMe phishing delivery host,campaign:DarkMe
domain,viewdocument.live,detect,high,2027-03-28,DarkMe phishing delivery host,campaign:DarkMe
domain,advancedfuturetechnology.com,detect,medium,2027-03-28,DarkMe phishing delivery host (suspended at time of publication),campaign:DarkMe
domain,sharedfuturetech.com,detect,medium,2027-03-28,DarkMe phishing delivery host (payload pulled at time of publication),campaign:DarkMe
domain,onlineview365.com,detect,high,2027-03-28,DarkMe MSI staging host,campaign:DarkMe
domain,thatawful.boutique,detect,high,2027-03-28,DarkMe RC4-decrypted C2 domain,campaign:DarkMe
ipv4,67.43.50.11,detect,high,2027-03-28,DarkMe C2 endpoint (TCP/7712),campaign:DarkMe
# sha256 2915efecf2a01ce0b3ef49c47666ec43c326e7804df10e5859db5f08eeca8a37 = clspack.exe — LEGITIMATE signed Microsoft binary abused as a hollowing target. Do NOT import as a blockable indicator; monitor execution location via Q11 instead.

# COM / registry persistence
CLSID (COM server, ProgID Coconout.Primary): {CFDC57BA-1705-45AF-BA10-EFC3D592982B}
TypeLib: {8F1576C0-BB08-4F05-87A6-268C0D548794}
InprocServer32 target: %AppData%\ComponentsFolder\Coconout.dll
Protocol handler key: HKCU\Software\Classes\Locked\shell\open\command
Run value: HKCU\Software\Microsoft\Windows\CurrentVersion\Run  "Locked" = explorer.exe "Locked://Newest"

# Payload / C2 crypto (pivot and malware-analysis context, not network/file IOCs)
Payload decryption key (company.cer, broken single-byte-effective RC4/XOR): Nobodygoingout
C2-string RC4 key (this sample): onlywayhere23!$$#@!!35@!12
Historical public-builder RC4 key (2024 campaigns; SonicWall/Trend Micro; NOT valid for this sample): noway123!$$#@35@!

# C2 command verbs (Spanish/Italian-derived mnemonics)
SHLEXE  execute shell command
ZIPALO  archive staging ("zip it")
COPALO  copy file ("copy it")
PASALO  exfiltrate ("pass it")
DELMAP  delete directory
STRFLS  enumerate a directory

# Non-standard C2 port
TCP/7712

Malware family: DarkMe (VB6 spy-RAT / infostealer)
Actor / cluster: Water Hydra (aka DarkCasino); historically overlapping with the EvilNum-led "Operation DarkCasino" tracked by NSFOCUS (Sept 2022); split into its own cluster by Nov 2023
Loader chain filenames: image.pif, propi.msi, prnfig.wsf, filetext2.txt, Coconout.dll, Use.dll, Finalized.dll, company.cer
Hollowing target (LEGITIMATE — do not block): clspack.exe, Microsoft-signed "Zip Package Creation Tool"
Historical zero-days abandoned in this campaign: CVE-2023-38831 (WinRAR extension spoofing, weaponized April 2023), CVE-2024-21412 (Windows Defender SmartScreen bypass, weaponized late 2023/early 2024)

# Attack Surface Reduction rule GUIDs (Microsoft Defender) — see §13 for deployment
be9ba2d9-53ea-4cdc-84e5-9b1eeee46550   Block executable content from email client and webmail
5beb7efe-fd9a-4556-801d-275e5ffc04cc   Block execution of potentially obfuscated scripts
d3e037e1-3eb8-44c8-a917-57927947596d   Block JavaScript or VBScript from launching downloaded executable content
01443614-cd74-433a-b99e-2ecdc07bfc25   Block executable files from running unless they meet a prevalence, age, or trusted list criterion

# Windows Script Host disablement
HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings!Enabled = 0 (REG_DWORD)

# Deployment audit checklist
[ ] WSH disabled fleet-wide, or scoped to non-developer populations
[ ] ASR rules above set to Block (not Audit) on pilot ring, then fleet
[ ] AppLocker/WDAC deny-list covers execution from %AppData%\*\*.exe and \*\*.dll
[ ] Mail gateway blocks .pif attachments and true-file-type PE content regardless of claimed extension
[ ] SACL auditing enabled on HKCU\Software\Classes\CLSID (registry object access)

TTP set: PE-as-image phishing (T1204.002/T1036.008), LOLBin script/installer abuse (T1218.007/T1059.005/T1112/T1218.011), COM/protocol-handler/Run-key persistence (T1546.015/T1546.001/T1547.001), process hollowing into a signed binary (T1055.012/T1036.005), RC4-obscured C2 on a non-standard port (T1071.004/T1571). Primary mitigations: M1038 (Execution Prevention), M1042 (Disable/Remove Feature or Program), M1040 (Behavior Prevention on Endpoint), M1047 (Audit), M1017 (User Training), M1026 (Privileged Account Management), M1018 (User Account Management / LAPS).

Prerequisites (all steps): local admin / GPO management rights on target endpoints; Microsoft Defender Antivirus present and not in passive mode for the ASR steps; a pilot ring defined before any fleet-wide rollout. Estimated deploy time: 1–2 hours for Steps 1–3 across a pilot ring; Steps 4–5 depend on your mail-gateway/SIEM vendor's change process.

Step 1 — Disable Windows Script Host

What it does: Prevents wscript.exe/cscript.exe from executing .vbs/.wsf/.js files, breaking the prnfig.wsf staging step. Why it works: the loader chain cannot reach the registry-import/rundll32 handoff if the WSH engine itself refuses to run.

Prerequisites: confirm no business-critical .vbs/.wsf logon scripts or line-of-business tooling depend on WSH before disabling fleet-wide. Reboot required: No.

PowerShell:
$path = 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings'
New-Item -Path $path -Force | Out-Null
New-ItemProperty -Path $path -Name 'Enabled' -Value 0 -PropertyType DWORD -Force | Out-Null
Write-Output "Windows Script Host disabled"

GPO path:
Computer Configuration > Administrative Templates > (custom ADMX or direct registry policy — WSH has no native ADMX; deploy via Group Policy Preferences registry item or a signed script)

Verify:
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings' -Name Enabled -EA SilentlyContinue).Enabled
# Expect: 0

Rollback:
Set-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows Script Host\Settings' -Name Enabled -Value 1
# No reboot required

Step 2 — Enable Attack Surface Reduction rules (script & executable-content abuse)

What it does: Blocks obfuscated-script execution, JS/VBScript launching downloaded executables, executable content from email/webmail, and low-prevalence executables. Why it works: covers the image.pif delivery step and the prnfig.wsf execution step independently of the WSH-disable control.

Prerequisites: Microsoft Defender Antivirus active (passive mode acceptable if a third-party AV is primary, per Microsoft's ASR compatibility notes); pilot in Audit mode for 1–2 weeks if these rules are not already deployed. Reboot required: No.

PowerShell:
$ids = @(
  'be9ba2d9-53ea-4cdc-84e5-9b1eeee46550',  # Block executable content from email client and webmail
  '5beb7efe-fd9a-4556-801d-275e5ffc04cc',  # Block execution of potentially obfuscated scripts
  'd3e037e1-3eb8-44c8-a917-57927947596d',  # Block JavaScript or VBScript from launching downloaded executable content
  '01443614-cd74-433a-b99e-2ecdc07bfc25'   # Block executable files from running unless they meet a prevalence, age, or trusted list criterion
)
Set-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled,Enabled
Write-Output "ASR rules set to Block"

GPO path:
Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus >
Microsoft Defender Exploit Guard > Attack Surface Reduction > Configure Attack Surface Reduction rules
(add each GUID above with value 1 = Block; use 2 = Audit for the pilot ring)

Verify:
$i = (Get-MpPreference).AttackSurfaceReductionRules_Ids
$a = (Get-MpPreference).AttackSurfaceReductionRules_Actions
for ($n=0; $n -lt $i.Count; $n++) { "$($i[$n]) => $($a[$n])" }
# Expect: 1 (Block) for each of the four GUIDs above

Monitor for false positives:
Event ID 1121 (Block) / 1122 (Audit) in Microsoft-Windows-Windows Defender/Operational.
If a legitimate internal WSF/installer tool trips it, add a targeted exclusion:
Add-MpPreference -AttackSurfaceReductionOnlyExclusions 'C:\Path\To\LegitimateTool.exe'

Rollback:
Set-MpPreference -AttackSurfaceReductionRules_Ids $ids -AttackSurfaceReductionRules_Actions Disabled,Disabled,Disabled,Disabled

Step 3 — AppLocker deny rule for execution from %AppData%

What it does: Denies EXE/DLL execution from user-writable AppData subfolders unless explicitly allowlisted. Why it works: breaks the chain at the point where Coconout.dll/Use.dll/Finalized.dll would otherwise load from %AppData%\ComponentsFolder\.

Prerequisites: AppLocker (or WDAC) available (Windows 10/11 Enterprise or Education for full policy flexibility); build and pilot an allowlist for any legitimate AppData-resident app (Electron apps, browser updaters, RMM agents) before enforcing. Reboot required: No (AppLocker policy refresh via gpupdate is sufficient); the Application Identity service must be running.

PowerShell (create + test in Audit mode first):
New-AppLockerPolicy -RuleType Publisher,Path -User Everyone -RuleNamePrefix "DenyAppDataExec" `
  -XmlPolicy | Set-AppLockerPolicy -Merge

# Minimal deny-path rule (adapt via the AppLocker MMC snap-in for a maintained allowlist):
# Deny EXE/DLL execution under %APPDATA%\* and %LOCALAPPDATA%\*, then add explicit Allow
# Publisher rules for any signed vendor tooling you need to exempt.

Verify (Audit mode first):
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections
Get-WinEvent -LogName "Microsoft-Windows-AppLocker/EXE and DLL" -MaxEvents 20

Rollback:
Set-AppLockerPolicy -XmlPolicy "C:\Path\To\PreviousPolicy.xml"
# or remove the rule collection: Remove-AppLockerPolicy (if fully rolling back AppLocker)

Step 4 — Block .pif at the mail gateway / secure email gateway

What it does: Stops image.pif (and any .pif) from reaching the inbox as an attachment, and flags/rewrites links whose true-file-type detonation resolves to a PE despite an image-looking URL or filename. Why it works: removes the initial-access step entirely.

Prerequisites: mail-flow rule or transport rule authoring rights (Exchange Online / on-prem Exchange / third-party SEG); Safe Attachments or equivalent detonation sandbox licensed and enabled. Reboot required: No.

Exchange Online PowerShell (illustrative — adapt file-type list to your standard):
New-TransportRule -Name "Block PIF Attachments" `
  -AttachmentExtensionMatchesWords "pif" `
  -RejectMessageReasonText "Blocked: .pif attachments are not permitted" `
  -Mode Enforce

Defender for Office 365:
Threat policies > Anti-malware > Common Attachment Types Filter > add "pif" to the blocked file-type list
Threat policies > Safe Attachments > enable dynamic delivery / true-file-type detonation on all recipient policies

Verify:
Send a benign test .pif from an external test mailbox and confirm rejection/quarantine in the message trace.

Rollback:
Disable-TransportRule -Identity "Block PIF Attachments"
# or remove "pif" from the Common Attachment Types Filter list

Step 5 — COM hijack registry auditing

What it does: Generates a Security-log event (4657) whenever a value under HKCU\Software\Classes\CLSID is created or modified, independent of Falcon coverage. Why it works: gives SIEM/SOAR a second, native-Windows detection path for the exact persistence mechanism this campaign relies on.

Prerequisites: Advanced Audit Policy Configuration available (Windows 8/Server 2012+); a SACL must be applied to the target registry key in addition to enabling the audit subcategory. Reboot required: No.

PowerShell / auditpol:
auditpol /set /subcategory:"Registry" /success:enable /failure:enable

# Apply a SACL to the CLSID hive (run as SYSTEM/admin; adjust for your SACL tooling of choice):
$acl = Get-Acl -Path 'Registry::HKEY_CURRENT_USER\Software\Classes\CLSID'
$rule = New-Object System.Security.AccessControl.RegistryAuditRule(
  "Everyone", "SetValue,CreateSubKey", "ContainerInherit", "None", "Success")
$acl.AddAuditRule($rule)
Set-Acl -Path 'Registry::HKEY_CURRENT_USER\Software\Classes\CLSID' -AclObject $acl

Verify:
auditpol /get /subcategory:"Registry"
Get-WinEvent -LogName Security -FilterXPath "*[System[EventID=4657]]" -MaxEvents 5

Rollback:
auditpol /set /subcategory:"Registry" /success:disable /failure:disable
# and remove the added RegistryAuditRule from the CLSID key's ACL via the same Get-Acl/Set-Acl pattern

5 of 12 chain steps carry an honest GAP rating — all five are in-memory/in-process behaviors (email content inspection aside) that Falcon's standard event model does not expose as a queryable field, by design. This pack compensates by detecting the deterministic artifacts each gapped step leaves behind (persistence writes, execution-location anomalies, network egress) rather than the step itself. Validation-gate criteria for the queries covering the "Good"/"Partial" rows are in §11.

Source snapshots saved verbatim under DarkMe-RAT-VB6-Hunt-sources/ alongside this file: 01-huntress-darkme.txt, 02-helpnetsecurity.txt, 03-sonicwall.txt, 04-blackarrow.txt, 05-trendmicro-cve-2024-21412.txt, 06-groupib-cve-2023-38831.txt.