EN PT-BR
← Voltar ao feed
medium

DarkCore RAT advertised with session-hijacking browser and HVNC; LNK-delivered sample analyzed by BlackFog

1 fonte(s) · 1 atualização(ões) · publicado 26/10/2026 07:05 · coletado há 6 dias

BlackFog researchers analyzed DarkCore, a native C++ remote access trojan advertised on a cybercrime marketplace (listing dated August 11, 2026) with credential theft, file transfer, hidden desktop control (HVNC) and a reverse proxy. Its bundled browser is marketed as reusing stolen session cookies to reach Gmail, WhatsApp, YouTube and MediaFire without passwords, routing traffic through the victim's IP so activity looks legitimate. Researchers verified components of the malware and a malicious shortcut, but did not confirm that every advertised browser capability works. A seller screenshot showing 118 credential rows does not establish the number of victims. Both approaches require an existing foothold on the endpoint and do not exploit a vulnerability in the targeted services.

Detalhes técnicos

  • Delivery sample: PdfView.lnk, disguised as a "PDF Report Launcher" with a PDF icon. It opens a minimized command window that downloads a legitimate World Bank PDF as a decoy and fetches ReportPDFReader.exe from update[.]cdnlinks[.]org. The original distribution method is unknown.
  • The shortcut obfuscates curl.exe and START via string slicing, character removal and CALL expansion. It tries to delete the Zone.Identifier alternate data stream before launching the files. The decoy download and payload download are independent.
  • The unsigned 64-bit Windows sample contains the DARKCORE01 marker and remote desktop/HVNC interfaces. The configuration is recovered from a decoder that rotates key bytes and XORs 758 bytes in the .data2 section.
  • C2 is direct TCP to 217.156.8[.]148:43592; Tor and WebSocket options are disabled. Naming fields use backgroundTaskHost.exe/backgroundTaskHost to imitate a Windows process, but installation and persistence flags are disabled in this build.
  • Additional modules can be mapped into memory or written to disk as DLLs with names starting "dc", loaded via LoadLibraryA and then deleted.
  • Researchers could not verify that the remotely hosted executable matches the analyzed sample.

Remediação

  • Correlate shortcut execution, suspicious curl downloads, the recovered C2 endpoint and transient "dc*" DLL activity.
  • Per Microsoft guidance, revoke compromised sessions as well as resetting credentials, and investigate attacker changes, since password resets alone do not contain session hijacking.
  • Treat the advertised account-hijacking functions as unvalidated claims.

Linha do tempo

  1. gbhackers.com ↗ · pub. 26/10/2026 07:05 · coletado 26/10 09:00 primeiro registro

    DarkCore RAT advertised with session-hijacking browser and HVNC; LNK-delivered sample analyzed by BlackFog

    ler a análise desta fonte

    BlackFog researchers analyzed DarkCore, a native C++ remote access trojan advertised on a cybercrime marketplace (listing dated August 11, 2026) with credential theft, file transfer, hidden desktop control (HVNC) and a reverse proxy. Its bundled browser is marketed as reusing stolen session cookies to reach Gmail, WhatsApp, YouTube and MediaFire without passwords, routing traffic through the victim's IP so activity looks legitimate. Researchers verified components of the malware and a malicious shortcut, but did not confirm that every advertised browser capability works. A seller screenshot showing 118 credential rows does not establish the number of victims. Both approaches require an existing foothold on the endpoint and do not exploit a vulnerability in the targeted services.

    Technical Details

    • Delivery sample: PdfView.lnk, disguised as a "PDF Report Launcher" with a PDF icon. It opens a minimized command window that downloads a legitimate World Bank PDF as a decoy and fetches ReportPDFReader.exe from update[.]cdnlinks[.]org. The original distribution method is unknown.
    • The shortcut obfuscates curl.exe and START via string slicing, character removal and CALL expansion. It tries to delete the Zone.Identifier alternate data stream before launching the files. The decoy download and payload download are independent.
    • The unsigned 64-bit Windows sample contains the DARKCORE01 marker and remote desktop/HVNC interfaces. The configuration is recovered from a decoder that rotates key bytes and XORs 758 bytes in the .data2 section.
    • C2 is direct TCP to 217.156.8[.]148:43592; Tor and WebSocket options are disabled. Naming fields use backgroundTaskHost.exe/backgroundTaskHost to imitate a Windows process, but installation and persistence flags are disabled in this build.
    • Additional modules can be mapped into memory or written to disk as DLLs with names starting "dc", loaded via LoadLibraryA and then deleted.
    • Researchers could not verify that the remotely hosted executable matches the analyzed sample.

    Remediation

    • Correlate shortcut execution, suspicious curl downloads, the recovered C2 endpoint and transient "dc*" DLL activity.
    • Per Microsoft guidance, revoke compromised sessions as well as resetting credentials, and investigate attacker changes, since password resets alone do not contain session hijacking.
    • Treat the advertised account-hijacking functions as unvalidated claims.