DarkMe RAT, RemControl Banking Trojan & ClickFix Loader Chains: OTX Pulse Analysis — Credential Theft Detection Pack | Security Arsenal

Threat Summary

Four concurrent OTX pulses paint a coherent picture: the credential theft ecosystem is shedding technical sophistication in favor of social engineering reliability, and it is working. Water Hydra's DarkMe RAT — a Visual Basic 6 spy-RAT that once depended on zero-days like CVE-2023-38831 (WinRAR) and CVE-2024-21412 (Internet Shortcut bypass) — has abandoned exploit delivery entirely in favor of plain phishing emails with process-hollowing payloads. The message is clear: defenders have patched the exploits, so the adversary pivoted to the one vulnerability that cannot be patched — the user.

In parallel, Group-IB's disclosure of RemControl reveals a mature Malware-as-a-Service Android banking trojan targeting over 30 financial institutions across Canada, France, Italy, Poland, Portugal, and Spain. Distributed via malvertising through fake TVTap IPTV download pages, RemControl abuses Android Accessibility Services to inject phishing overlays, stream device screens in real time, and harvest banking PINs. Notably, AI-generated overlay templates suggest the operator (tracked as UNKK) is using generative tooling to scale target coverage — a force multiplier for MaaS affiliates.

The third pulse exposes the infrastructure backbone: AS202412 (OMEGATECH LTD, Seychelles), a bulletproof hosting provider supporting at least four distinct malware chains — DarkGate, Matanbuchus, Amatera, and Amadey — all delivered via ClickFix fake-CAPTCHA pages that trick victims into pasting malicious commands into the Windows Run dialog. Some chains leverage EtherHiding (blockchain-based C2 resolution), making takedown nearly impossible. Finally, the Red Heron campaign demonstrates mass-scale WordPress and enterprise appliance exploitation (including CVE-2022-0847 Dirty Pipe and multiple 2026 CVEs) from a single persistent IP, culminating in the theft of over 18,000 government records — credentials that will inevitably surface in dark web markets and fuel secondary intrusions.

Collectively: initial access is cheap, credential theft is industrialized, and the underground supply chain from breach to dark web sale is shorter than ever.

Threat Actor / Malware Profiles

DarkMe RAT (Water Hydra)

Distribution: Phishing emails with social-engineered lures (financial/cryptocurrency themes). Historical delivery included CVE-2023-38831 and CVE-2024-21412 weaponized archives; current campaigns use direct attachment/link social engineering.
Payload behavior: Visual Basic 6-compiled spy-RAT with infostealer functionality — credential harvesting, cryptocurrency wallet theft, screen capture, and remote command execution.
Execution: Process hollowing into legitimate Windows processes to evade parent-child heuristic detection.
C2: Communicates with actor-controlled domains including advancedfuturetechnology.com and thatawful.boutique.
Persistence: Registry Run keys and scheduled tasks typical of VB6 RAT lineage.

RemControl (UNKK / MaaS)

Distribution: Malvertising redirecting to fake TVTap IPTV APK download pages.
Payload behavior: Android banking trojan abusing Accessibility Services to inject AI-generated phishing overlays over 30+ banking apps, capture PINs, and stream the device screen to operators in real time.
C2: Telegram-based dead-drop resolution for C2 configuration — blends with legitimate traffic and resists domain blocking.
Persistence: Accessibility Service permission abuse; requests ignore-battery-optimizations to survive device sleep.
Anti-analysis: Emulator detection, overlay obfuscation, staged payload decryption.

ClickFix Chains (DarkGate / Matanbuchus / Amatera / Amadey)

Distribution: Fake CAPTCHA pages on compromised legitimate sites instructing victims to paste commands into the Windows Run dialog (ClickFix technique).
Infrastructure: Disposable domains on durable bulletproof hosting — AS202412 (OMEGATECH LTD, Seychelles). IPs observed include 91.92.240.127, 91.92.243.161, 178.16.52–55.x, and 158.94.208.x ranges.
C2 innovation: EtherHiding — C2 addresses stored in blockchain smart contracts, immune to traditional takedown.
Objective: Loader delivery funneling into stealer and RAT payloads; credentials monetized via dark web initial access brokers.

Red Heron (WordPress/Enterprise Exploitation)

Profile: Suspected Chinese-speaking actor operating UTC+8, persistent use of single IP 104.225.153.141 (AS25820, IT7 Networks).
Targets: WordPress sites, ZyXEL switches, enterprise platforms across 55+ countries; government and technology sectors.
Impact: 18,000+ government records exfiltrated — a direct pipeline of credentials into underground markets.

IOC Analysis

The pulse set contains four operational indicator classes:

File hashes (MD5/SHA1/SHA256): 23+ DarkMe artifacts and 28+ RemControl APK hashes. Operationalize via EDR blocklists and retro-hunts. SHA256 values should be pushed to your SIEM threat-intel tables; MD5/SHA1 retained for legacy tooling correlation only.
Domains: advancedfuturetechnology.com, thatawful.boutique, alianzeg.shop, plus disposable ClickFix domains with similar naming patterns. Enforce DNS sinkholing and TLS inspection alerting. Watch for newly-registered domains matching the .boutique/.shop TLD pattern seen in these campaigns.
IPv4: The AS202412 netblocks (91.92.240.0/22, 178.16.52.0/22, 158.94.208.0/22) warrant preemptive egress blocking — bulletproof hosting rarely serves legitimate traffic. Block 104.225.153.141 at the perimeter and retro-search web/proxy logs for WordPress exploitation attempts from this source.
CVEs: Prioritize patching CVE-2022-0847 (Dirty Pipe), CVE-2023-38831 (WinRAR), CVE-2024-21412 (SmartScreen bypass), and the 2026 WordPress plugin CVEs (CVE-2026-34908/09/10, CVE-2026-63030, CVE-2026-60137, CVE-2026-7273). Even where the actor has moved to social engineering, unpatched exploit paths remain viable for other actors reusing this infrastructure.

Tooling: Decode and pivot with AbuseIPDB/GreyNoise for IP reputation, VirusTotal for hash enrichment, urlscan.io for ClickFix page fingerprinting, and OTX pulse subscriptions for continuous indicator refresh.

Detection Engineering

YAML

---
title: DarkMe RAT Process Hollowing via VB6 Payload
id: 9c4e1a7b-2f3d-4e5a-8b6c-1d2e3f4a5b6c
status: experimental
description: Detects process hollowing behavior associated with DarkMe RAT (Water Hydra) where a VB6-compiled payload spawns and hollows a legitimate Windows process.
author: Security Arsenal Threat Intelligence
references:
    - https://www.huntress.com/blog/darkme-rat-abandons-exploits
date: 2026/09/23
modified: 2026/09/23
tags:
    - attack.defense_evasion
    - attack.t1055.012
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection_suspended:
        CommandLine|contains:
            - '/c start '
        Image|endswith:
            - '\svchost.exe'
            - '\explorer.exe'
            - '\notepad.exe'
            - '\regsvr32.exe'
    selection_parent:
        ParentImage|endswith:
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\powershell.exe'
            - '\cmd.exe'
    condition: all of selection_*
falsepositives:
    - Legitimate administrative scripting
level: high
---
title: ClickFix Fake CAPTCHA Run Dialog Execution
id: 7a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects ClickFix technique execution where users are tricked into pasting commands into the Windows Run dialog, spawning mshta/powershell from explorer.exe - associated with DarkGate, Matanbuchus, Amatera and Amadey chains on AS202412.
author: Security Arsenal Threat Intelligence
references:
    - https://activesoc.blackhillsinfosec.com/blog/disposable-domains-durable-hosting
date: 2026/09/23
modified: 2026/09/23
tags:
    - attack.execution
    - attack.t1204.004
    - attack.t1059
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\mshta.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\curl.exe'
    selection_cmd:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - 'Invoke-'
            - 'iex'
            - 'DownloadString'
            - 'mshta '
    condition: selection_parent and selection_child and selection_cmd
falsepositives:
    - Rare; legitimate Run-dialog usage does not typically chain explorer to script interpreters with URLs
level: critical
---
title: Outbound Connection to Bulletproof Hosting AS202412 Netblocks
id: 3f4a5b6c-7d8e-9f0a-1b2c-3d4e5f6a7b8c
status: experimental
description: Detects network connections to OMEGATECH LTD (AS202412, Seychelles) bulletproof hosting ranges used by DarkGate, Matanbuchus, Amatera and Wacatac C2 infrastructure.
author: Security Arsenal Threat Intelligence
date: 2026/09/23
modified: 2026/09/23
tags:
    - attack.command_and_control
    - attack.t1071
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationIp|startswith:
            - '91.92.240.'
            - '91.92.243.'
            - '178.16.52.'
            - '178.16.54.'
            - '178.16.55.'
            - '158.94.208.'
    filter:
        Initiated: 'false'
    condition: selection and not filter
falsepositives:
    - None expected; AS202412 serves no known legitimate enterprise services
level: critical

KQL — Microsoft Sentinel / Defender

// Hunt: DarkMe/RemControl/ClickFix IOCs + ClickFix behavior chain
// Microsoft Sentinel — last 14 days
let DarkMeHashes = dynamic(["1c923c685f97e556f241d0f1880283500a61dc7ecae8cafe75f34c720ff6b918","0928d307c1fe675079d40c3a3d1f5c78"]);
let BPH_IPs = dynamic(["91.92.240.127","91.92.243.161","178.16.55.232","178.16.54.40","158.94.208.213","158.94.208.104","178.16.52.101","104.225.153.141"]);
let BadDomains = dynamic(["advancedfuturetechnology.com","thatawful.boutique","alianzeg.shop"]);
let NetworkHits = DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP in (BPH_IPs) or RemoteUrl has_any (BadDomains)
| project TimeGenerated, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| extend HitType = "Network IOC";
let ClickFixBehavior = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("mshta.exe","powershell.exe","pwsh.exe","curl.exe","wscript.exe")
| where ProcessCommandLine has_any ("http://","https://","iex","Invoke-","DownloadString")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, AccountName
| extend HitType = "ClickFix Run-Dialog Execution";
let HashHits = DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where SHA256 in (DarkMeHashes) or MD5 in (DarkMeHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, MD5, InitiatingProcessCommandLine
| extend HitType = "DarkMe Hash Match";
union NetworkHits, ClickFixBehavior, HashHits
| sort by TimeGenerated desc

PowerShell

# Security Arsenal - DarkMe / ClickFix / Loader IOC Hunt
# Run elevated on suspect endpoints. Outputs consolidated findings.

$report = @()

# 1. Network connections to bulletproof hosting (AS202412) + Red Heron IP
$badIPs = @("91.92.240.127","91.92.243.161","178.16.55.232","178.16.54.40",
            "158.94.208.213","158.94.208.104","178.16.52.101","104.225.153.141")
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
         Where-Object { $badIPs -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $p = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $report += [pscustomobject]@{
        Type="NetworkIOC"; Detail="$($p.ProcessName) -> $($c.RemoteAddress):$($c.RemotePort)"
        Path=$p.Path }
}

# 2. DNS cache check for DarkMe / ClickFix C2 domains
$badDomains = @("advancedfuturetechnology.com","thatawful.boutique","alianzeg.shop")
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue |
       Where-Object { $n=$_.Name; $badDomains | Where-Object { $n -like "*$_*" } }
foreach ($d in $dns) {
    $report += [pscustomobject]@{ Type="DNSIOC"; Detail=$d.Name; Path=$d.Data }
}

# 3. Registry Run-key persistence (DarkMe VB6 RAT behavior)
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce")
foreach ($k in $runKeys) {
    if (Test-Path $k) {
        Get-ItemProperty $k | ForEach-Object {
            $_.PSObject.Properties | Where-Object {
                $_.Value -match "AppData|Temp|\.vbs|mshta|powershell" -and
                $_.Name -notmatch "^PS"
            } | ForEach-Object {
                $report += [pscustomobject]@{ Type="Persistence"; Detail="$k\$($_.Name)"; Path=$_.Value }
            }
        }
    }
}

# 4. Scheduled tasks executing from user-writable paths (loader persistence)
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $t = $_
    $t.Actions | Where-Object { $_.Execute -match "AppData|Temp|Users\\Public" } |
    ForEach-Object {
        $report += [pscustomobject]@{ Type="SuspiciousTask"; Detail=$t.TaskName; Path=$_.Execute }
    }
}

# 5. Hash sweep of common staging dirs for DarkMe samples
$badSHA256 = @("1c923c685f97e556f241d0f1880283500a61dc7ecae8cafe75f34c720ff6b918",
               "19fef425c3a774e493526126a441a31971db8ac5af84c1d9eef15a272ba02ec1")
$dirs = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\Users\Public")
foreach ($dir in $dirs) {
    Get-ChildItem $dir -Recurse -File -Include *.exe,*.dll,*.vbs,*.js -ErrorAction SilentlyContinue |
    ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($badSHA256 -contains $h.ToLower()) {
            $report += [pscustomobject]@{ Type="MalwareHash"; Detail=$h; Path=$_.FullName }
        }
    }
}

$report | Format-Table -AutoSize
if ($report) { Write-Host "[!] $($report.Count) indicator(s) found - ISOLATE HOST and initiate IR." -ForegroundColor Red }
else { Write-Host "[+] No indicators found on $env:COMPUTERNAME" -ForegroundColor Green }

Response Priorities

Immediate (0–4 hours):

Block all AS202412 netblocks (91.92.240.0/22, 178.16.52.0/22, 158.94.208.0/22) and 104.225.153.141 at egress firewalls and web proxies.
Sinkhole advancedfuturetechnology.com, thatawful.boutique, and alianzeg.shop in DNS; push all SHA256 hashes to EDR blocklists.
Run the KQL hunt and PowerShell sweep against financially-sensitive endpoints (finance, treasury, executive assistants) — the pulse set explicitly targets the finance sector.
Alert help desk to the ClickFix lure: any user reporting a "CAPTCHA that asked me to press Win+R" is a confirmed incident.

Within 24 hours:

Force credential resets for any user whose endpoint shows DarkMe or loader execution artifacts. Assume full credential compromise — DarkMe harvests browser stores, email credentials, and crypto wallets.
Review mobile device fleet for sideloaded APKs matching RemControl hashes; enforce MDM policies blocking Accessibility Service grants to non-store applications.
Audit VPN, O365/Entra, and banking portal logins for sessions originating from anonymization infrastructure following any endpoint hit. Watch for these credentials appearing in dark web stealer-log marketplaces — monitor for your domains in stealer log feeds.
Retro-search web server logs for exploitation attempts from 104.225.153.141 against WordPress assets; if any WordPress instance was compromised, assume database credential theft.

Within 1 week:

Deploy the Sigma rules above to production SIEM with tuning; add the ClickFix explorer→script-interpreter chain to high-fidelity alerting.
Implement Windows policy controls: disable mshta execution for standard users, constrain Win+R execution via WDAC/AppLocker where feasible, and enable PowerShell Script Block Logging enterprise-wide.
Patch CVE-2023-38831 (WinRAR), CVE-2024-21412, CVE-2022-0847, and the 2026 WordPress plugin CVEs across the estate; audit and remove abandoned WordPress plugins — they are the Red Heron entry point.
Deploy network-layer EtherHiding countermeasures: alert on endpoints making RPC calls to public blockchain nodes from workstations, as this behavior has almost no legitimate enterprise use.
Enroll in continuous dark web credential monitoring for corporate domains — the 18,000-record government breach demonstrates how quickly exploited credentials propagate to underground markets.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

DarkMe RAT, RemControl Banking Trojan & ClickFix Loader Chains: OTX Pulse Analysis — Credential Theft Detection Pack