DarkMe RAT Campaign Uses Phishing and PIF Files Instead of Exploits

Sep 22, 2026 · Original article ↗

Summary

Huntress analyzed two DarkMe infections delivered through phishing emails and disguised PIF files. The campaign uses a multi-stage VB6 loader, custom protocol-handler persistence, and process hollowing, with technical indicators and detection guidance provided.

Key points

Huntress identified DarkMe in two customer environments on August 31, 2026; users were tricked into running a PIF file linked from email.
The PIF downloaded a remote MSI, which unpacked scripts and three VB6 loader DLLs before launching the RAT.
Unlike earlier DarkMe campaigns that used WinRAR and SmartScreen vulnerabilities, this campaign relied on social engineering rather than exploits.
The malware registers a custom Locked:// protocol handler and a Run key to persist and obscure its launch through Explorer.
A process gate checks for 329 user applications; the final loader hollows a signed Microsoft clspack.exe copied into AppData.
The RAT can steal cryptocurrency wallets, capture screenshots, enumerate antivirus products, manipulate files, and execute commands.
Huntress reported C2 at thatawful[.]boutique and 67.43.50[.]11:7712, and recommended hunting for the execution chain and removing the malware’s files and persistence.

Article Details

Attack Vectors: A phishing email linked to a URL presented as an image; the server delivered an executable PIF file instead.
The PIF launched msiexec to download and quietly run an MSI installer from attacker-used infrastructure.
The MSI extracted files and ran a WSF staging script, which registered a COM server and invoked it through rundll32.exe /sta.
The malware checked running processes for user applications and exited if none of its listed applications were found.
The loaders registered a custom Locked:// protocol handler and a Run key that launched explorer.exe with that URI to restore execution at logon.
The final loader decrypted a payload and used process hollowing to run it inside a signed clspack.exe copied to the user's AppData directory.
Defensive Notes: Alert on rundll32.exe invoked with /sta and a GUID but no DLL path, and on msiexec fetching a remote MSI through a URL argument to /i.
Alert on reg.exe importing files from user-writable locations and on wscript.exe or cscript.exe running WSF files from AppData, especially when they launch reg.exe or rundll32.exe.
Monitor execution of PIF files and signed Microsoft binaries such as clspack.exe running from AppData instead of System32 or SysWOW64.
Inspect nonstandard protocol handlers under HKCU\Software\Classes\*\shell\open\command and Run-key entries that invoke explorer.exe with a custom URI scheme.
Monitor outbound TCP port 7712 for possible DarkMe C2 traffic.
For remediation, isolate affected hosts, terminate the hollowed clspack.exe process, remove the staging files and persistence registrations, and reset affected-user credentials; treat cryptocurrency wallets used on the host as compromised.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`advancedfuturetechnology[.]com`	Identified as a host that served the malicious PIF payload during the campaign.
DOMAIN	`megchartedbk7[.]com`	Domain reported to resolve to the same IP as the DarkMe C2 server.
DOMAIN	`onlineview365[.]com`	Attacker-used MSI staging host for the DarkMe infection chain.
DOMAIN	`readonline365[.]com`	Malicious delivery host that served the PIF payload.
DOMAIN	`sharedfuturetech[.]com`	Identified as a host that served the DarkMe payload and later hosted a separate malicious ClickFix lure.
DOMAIN	`storageonline[.]me`	Identified as a host serving the malicious PIF delivery campaign.
DOMAIN	`thatawful[.]boutique`	DarkMe C2 domain recovered by decrypting the malware's configuration.
DOMAIN	`viewdocument[.]live`	Identified as a host serving the malicious PIF delivery campaign.
IPV4	`67[.]43[.]50[.]11`	DarkMe C2 server IP; the malware communicated with it over TCP port 7712.
SHA256	`1c923c685f97e556f241d0f1880283500a61dc7ecae8cafe75f34c720ff6b918`	Hash of the malicious prnfig.wsf staging script.
SHA256	`2915efecf2a01ce0b3ef49c47666ec43c326e7804df10e5859db5f08eeca8a37`	Hash listed for the signed clspack.exe binary hollowed to host the DarkMe payload.
SHA256	`3052352ac811c48590f0239281312c35560fc06b4dc39790e365eb1e7cab8634`	Hash of the DarkMe stage-2 loader, Use.dll.
SHA256	`394c93dfbb7581c66a23c52b20cd90b31415c0825a2eab7107e60ee3fe693c04`	Hash of the malicious image.pif initial dropper.
SHA256	`4a18f65ab7de7be385cbcebc78c9ae49334294f93726822b8900f9b7a324a6b0`	Hash of the DarkMe stage-1 COM loader, Coconout.dll.
SHA256	`52b242047a8055c0936b384b952c1c16c1072a590610140b01f4acefa8ae883a`	Hash of filetext2.txt, used to import the malicious COM registration.
SHA256	`54ed18aa883b53794810be0428b3a0167758183c5b3ba5660af747dc81dd5b76`	Hash of the encrypted DarkMe payload stored as company.cer.
SHA256	`9fb5888f9ac99227a35f3e08ca08bfb9eed676e1f91638599eba0d7a5aac847f`	Hash of the exemsi-wrapped MSI used to stage the DarkMe loaders.
SHA256	`d7185bd7b450b478c793ece3025bdd867eed70bb7b739a5f26375b5ba6cf0d93`	Hash of the DarkMe stage-3 loader, Finalized.dll.
URL	`hxxps[:]//onlineview365[.]com/propi[.]msi`	URL used by the PIF to download the malicious staging MSI.
URL	`hxxps[:]//readonline365[.]com/view/image[.]png`	Phishing-link URL that delivered the malicious image.pif file.