DarkCloud Stealer Evolves: New VB6 Obfuscation and Crypto Wallet Theft Make Malware More Dangerous Than Ever

DarkCloud Stealer has evolved with a full VB6 rewrite, introducing a VB6-driven Caesar cipher for string encryption and requiring researchers to reverse‑engineer VB6’s RNG to decrypt stored strings, according to TRU.

The malware targets credentials and financial data, browser-stored passwords and cookies, credit card details, FTP credentials, and email client data, and it now focuses on crypto-wallets such as Electrum, Exodus, Zcash, Atomic, Guarda, and MetaMask, with MetaMask directories in Chrome and Edge specifically noted.

It also performs system reconnaissance via WMI queries and includes extensive sandbox and VM checks, including a test that fails if there are not more than 50 processes running and checks against VMware, VirtualBox, and Microsoft virtual environments, as well as looking for analysis tools like Wireshark, Procmon, IDA Pro, and Joe Sandbox indicators.

Data exfiltration occurs through multiple channels—SMTP, Telegram, FTP, and a Web Panel—after which stolen data is sent as JSON in multipart/mixed messages or uploaded to attacker-controlled endpoints, with PCAPs captured by eSentire showing exfiltration to mail servers and Telegram.

Active phishing campaigns are underway, with DarkCloud marketed via darkcloud.onlinewebshop[.]net and a Telegram handle (@BluCoder), and defenders are urged to tighten email security, endpoint detection, and outbound traffic monitoring to detect compromises early.