CampaignPublished 7 Aug 2025Updated 6 Sep 2025

New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer

Source AlienVault OTX General

Description

Unit 42 researchers have identified a shift in the delivery method and obfuscation techniques used for distributing DarkCloud Stealer. The new infection chain, observed since April 2025, involves ConfuserEx obfuscation and a final payload written in Visual Basic 6. The attack begins with phishing emails containing compressed archives (TAR, RAR, or 7Z) that include JavaScript or Windows Script files. These files download and execute a PowerShell script, which then drops an executable protected by ConfuserEx. The final payload is a VB6 executable injected into a legitimate process using RunPE techniques. The malware employs various obfuscation methods, including anti-tampering, symbol renaming, and proxy call methods, to complicate analysis and evade detection.

Impact

For European organizations, the DarkCloud Stealer campaign poses a considerable risk primarily through information theft. The malware’s ability to stealthily inject into legitimate processes and evade detection means that sensitive data such as credentials, personal identifiable information (PII), and intellectual property could be exfiltrated without immediate detection. The phishing-based delivery vector exploits common user behaviors, increasing the likelihood of successful infection across diverse sectors including finance, healthcare, government, and critical infrastructure. The use of compressed archives and scripting files may bypass some email security filters if not properly configured. Additionally, the obfuscation and anti-analysis techniques complicate incident response and forensic investigations, potentially delaying mitigation and increasing exposure time. This threat could also facilitate lateral movement within networks, enabling attackers to escalate privileges or deploy additional payloads. The medium severity rating reflects the campaign’s moderate ease of exploitation combined with impactful data theft capabilities, which can lead to reputational damage, regulatory fines under GDPR, and operational disruptions.

Defensive guidance

European organizations should implement a multi-layered defense strategy tailored to this threat’s infection chain and evasion techniques. Specifically: 1) Enhance email security by deploying advanced sandboxing and attachment inspection capable of unpacking compressed archives (TAR, RAR, 7Z) and analyzing embedded scripts. 2) Enforce strict PowerShell execution policies and enable logging and monitoring of PowerShell activity to detect suspicious script downloads and executions. 3) Deploy endpoint detection and response (EDR) solutions with capabilities to detect process injection and RunPE techniques, focusing on anomalous behavior within legitimate processes. 4) Use application whitelisting to restrict execution of unauthorized scripts and executables, especially those originating from email attachments or temporary directories. 5) Conduct targeted user awareness training emphasizing the risks of opening compressed attachments and executing unknown scripts. 6) Maintain up-to-date threat intelligence feeds to block known malicious hashes and IP addresses associated with this campaign. 7) Implement network segmentation and strict egress filtering to limit malware communication with command and control servers. 8) Regularly audit and harden persistence mechanisms to detect and remove unauthorized registry or service modifications. These measures go beyond generic advice by addressing the specific infection vectors, obfuscation methods, and stealth techniques used by DarkCloud Stealer.

Indicators of compromise

IP addresses 1

176.65.142.190

Hashes 15

92f3a9cd6fdc829b5239fb60acfa619f
b953abe62f49a3fc099aee0ff1027609
e4f6fbf6b952148147b14df27b48c124
6d57b5dbe9adc1ea7224c11637a45427d8ffbbdb
b90df42f2218e59097a1df29cf5b8c88bb2e7922
edc7abadae7adf88e99dc5fc52cbb736bf3b6bdd
24552408d849799b2cac983d499b1f32c88c10f88319339d0eec00fb01bb19b4
2bd43f839d5f77f22f619395461c1eeaee9234009b475231212b88bd510d00b7
6b8a4c3d4a4a0a3aea50037744c5fec26a38d3fb6a596d006457f1c51bbc75c7
72d3de12a0aa8ce87a64a70807f0769c332816f27dcf8286b91e6819e2197aa8

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Aug 2025, 21:48 UTC

MITRE ATT&CK techniques10 from threat tags

Technical details

Indicators of compromise

IP addresses 1

Hashes 15

Community reviews

Related threats