New Infection Chain and Confuser Ex-Based Obfuscation for Dark Cloud Stealer
Summary: Unit 42 researchers observed a shift in DarkCloud Stealer's delivery beginning in early April 2025, with three attack chains that start from phishing emails carrying TAR, RAR, or 7Z archives containing either a JavaScript file or a Windows Script File. The chains download a PowerShell script from an open directory server, which drops a ConfuserEx-protected .NET executable that decrypts a 3DES-encrypted VB6 payload and injects it via process hollowing into RegAsm.exe.
What you should know: The final payload runs inside RegAsm.exe, a legitimate .NET Framework utility, so a process-level allowlist or reputation check would wave it through. The malware author has made almost every stage of all three chains obfuscated or protected, which means signature-based detection has little to match on.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026