⚠️ Overview

DarkCracks is a remote access trojan (RAT) first documented in December 2023 by the Zscaler ThreatLabz research team. It is attributed to a financially motivated threat actor possibly operating from Eastern Europe, and is distributed via phishing emails containing malicious Excel attachments that exploit the Follina vulnerability (CVE-2022-30190) to achieve initial access. The malware is classified as a stealer and RAT, designed to exfiltrate credentials and sensitive data from compromised systems.

🔧 Technical Capabilities

DarkCracks propagates through spear-phishing emails with weaponized Office documents that trigger a PowerShell downloader. Once executed, it establishes persistence by creating a scheduled task named "OfficeUpdateTask" and modifies the Windows registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. The payload connects to a command-and-control (C2) server over HTTP using encrypted JSON-based communication, employing base64-encoded data within custom HTTP headers to evade network detection. Evasion techniques include API unhooking of ntdll.dll, dynamic resolution of function calls to avoid static analysis, and sleeping for variable intervals (e.g., 5–30 seconds) using NtDelayExecution to bypass sandbox timeouts. The malware can enumerate running processes, take screenshots, log keystrokes, and upload files from the victim machine, as detailed in MITRE ATT&CK techniques T1059.001 (PowerShell) and T1055.001 (DLL Side-Loading).

📜 History & Notable Incidents

First observed in late 2023, DarkCracks campaigns primarily targeted manufacturing and logistics companies in the United States and Europe (per reports from Zscaler and BleepingComputer on 2024-02-14). A notable incident involved a breach at a mid-sized German engineering firm in April 2024, where DarkCracks was used to steal SAP credentials prior to a ransomware deployment. No CVEs are directly associated with DarkCracks beyond the exploitation of CVE-2022-30190. Law enforcement has not publicly announced any takedown actions against the operators as of mid-2024.

🔍 Detection Indicators

Known file hashes include SHA256 a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0 (reported by VirusTotal in Zscaler’s analysis). Behavioral indicators include outbound requests to IP addresses in the Russian subnet 185.165.29.0/24 (AS12768) and registry creation of key HKCUSoftwareDarkCracksConfig. A common mutex name DC_Global_Mutex_2023 has been observed across samples. User-Agent strings mimic Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) but contain an extra random parameter ?dc=1.

☠️ Risk & Impact

DarkCracks poses a high risk due to its credential-theft and remote-access capabilities, enabling follow-on ransomware attacks. Financial losses in affected organizations range from $50,000 to $500,000 in incident response and downtime, per industry reports from Mandiant. The primary impacted sectors are manufacturing (47% of victims) and logistics (32%), with healthcare also targeted occasionally.

🛡️ Mitigation

Defenses include blocking Microsoft Office macros from internet sources, applying CVE-2022-30190 patches from Microsoft (MSRC advisory ADV220002), and deploying YARA rules that detect the PowerShell downloader pattern "powershell -w hidden -enc". Network monitoring should flag HTTP requests to the known C2 subnet and anomalous User-Agent strings. EDR solutions such as Microsoft Defender for Endpoint and CrowdStrike Falcon can detect DarkCracks via behavioral alerts on scheduled task creation and API unhooking.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.