{"id":6923,"date":"2025-09-15T10:03:28","date_gmt":"2025-09-15T10:03:28","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/09\/15\/darkcloud-stealer-attacking-financial-companies-with-weaponized-rar-attachments\/"},"modified":"2025-09-15T10:03:28","modified_gmt":"2025-09-15T10:03:28","slug":"darkcloud-stealer-attacking-financial-companies-with-weaponized-rar-attachments","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/09\/15\/darkcloud-stealer-attacking-financial-companies-with-weaponized-rar-attachments\/","title":{"rendered":"DarkCloud Stealer Attacking Financial Companies With Weaponized RAR Attachments"},"content":{"rendered":"

DarkCloud Stealer Attacking Financial Companies With Weaponized RAR Attachments
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

DarkCloud Stealer has recently emerged as a potent threat targeting financial organizations through convincing phishing campaigns. Adversaries employ weaponized RAR attachments masquerading as legitimate documents to deliver a multi-stage JavaScript-based payload.<\/p>\n

Upon opening the archive, victims execute a VBE script that leverages Windows Script Host to initiate a PowerShell downloader hidden in innocuous-seeming image files.<\/p>\n

This initial access vector exploits users\u2019 trust in routine financial correspondence, triggering an automated chain of decoding and decryption steps designed to evade conventional security controls.<\/p>\n

In early September 2025, security teams observed a dramatic uptick in malicious RAR attachments sent to corporate email accounts<\/a> within the banking sector.<\/p>\n

CyberProof analysts identified that the archive named \u201cProof of Payment.rar\u201d contains a VBE script which, when executed, calls PowerShell to download an embedded JPG file named universe-1733359315202-8750.jpg<\/code>.<\/p>\n

\n
\"\"
Device timeline showing the download activty from user (Source \u2013 CyberProof)<\/figcaption><\/figure>\n<\/div>\n

The stealer\u2019s loader is concealed within this image, and the decoding routine extracts the .NET DLL module directly from image pixel data.<\/p>\n

CyberProof researchers noted<\/a> that the PowerShell script rigorously checks memory offsets to locate a distinct BMP header pattern before carving out the loader DLL.<\/p>\n

The following snippet illustrates the core loop used for scanning the downloaded image bytes:-<\/p>\n

for ($i=0; $i -lt $data.Length - $header. Length; $i++) {\n    $match = $true\n    for ($j=0; $j -lt $header.Length; $j++) {\n        if ($data[$i + $j] -ne $header[$j]) { $match = $false; break }\n    }\n    if ($match) { $offset = $i; break }\n}<\/code><\/pre>\n
Once the DLL is reconstructed in memory, the script invokes [Reflection.Assembly]::Load()<\/code> to execute the loader without ever touching disk.<\/p>\n
Persistence and Credential Theft<\/strong><\/h2>\n
After loading into memory, DarkCloud Stealer establishes persistence by copying a JavaScript payload to the Windows Run registry key under a disguised filename (M3hd0pf.exe<\/code> masquerading as MSBuild.exe), ensuring execution on every user login.<\/p>\n
The stealer then injects into legitimate processes like MSBuild.exe and mtstocom.exe using process hollowing techniques, enabling it to siphon saved credentials from browser databases such as Chrome\u2019s Login Data<\/code>.<\/p>\n
Alerts from endpoint detection<\/a> platforms confirm DPAPI access events and memory mapping into browser processes, revealing attempts to decrypt stored passwords directly in memory.<\/p>\n
\n
\"\"
Stolen data being sent to remote IPs (Source \u2013 CyberProof)<\/figcaption><\/figure>\n<\/div>\n
Finally, stolen data is staged in user directories and exfiltrated via FTP and HTTP channels to dynamic domain clusters (.shop, .xyz), complicating network-based detection<\/a>.<\/p>\n
Financial institutions are urged to monitor for anomalous VBE\/VBS execution, unexpected registry Run key modifications, and JavaScript files in public download folders to rapidly detect and disrupt this insidious campaign.<\/p>\n
Boost\u00a0your\u00a0SOC and help your team protect your business with free top-notch threat intelligence:\u00a0Request TI Lookup Premium Trial<\/a>.<\/code><\/strong><\/p>\n
The post DarkCloud Stealer Attacking Financial Companies With Weaponized RAR Attachments<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
DarkCloud Stealer Attacking Financial Companies With Weaponized RAR Attachments DarkCloud Stealer has recently emerged as a potent threat targeting financial organizations through convincing phishing campaigns. Adversaries employ weaponized RAR attachments masquerading as legitimate documents to deliver a multi-stage JavaScript-based payload. Upon opening the archive, victims execute a VBE script that leverages Windows Script Host to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-6923","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6923"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=6923"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/6923\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=6923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=6923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=6923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}