Log InTake a Virtual TourGet a Demo
Research

A YARA Rule for Threat Hunting DarkCloud Stealer

It is one thing to read threat intelligence, but it is another thing to maximize its value and operationalize it for efficient and effective hunting. We analyzed several DarkCloud stealer samples to craft a hunting YARA rule designed to single out DarkCloud samples or files exhibiting similar capabilities.

What is DarkCloud Stealer?

DarkCloud is an information stealer discovered by researchers in 2022, with its final payload written in Visual Basic 6. It is commonly disseminated via phishing emails relying heavily on social engineering. Once the email persuades users to click on the malicious link, the malware is loaded into memory, establishes persistence mechanisms, and then begins collecting the targeted information before ultimately exfiltrating it. The most commonly affected sectors are government, legal and finance, energy, manufacturing and healthcare across North and South America as well as Europe.

In 2023, DarkCloud was spotted for sale in cybercrime sites, offering a menu-driven builder that allows users to choose the method of exfiltration, the type of information to steal (credentials, cookies, IP address, keylogger logs, contacts, etc), and which cryptocurrency wallets to target. Like most information stealers, DarkCloud focuses on high-value data such as user session credentials and Personal Identifiable Information (PII), typically for purposes such as financial gain, identity theft, and various forms of system compromise.

What is the Use Case for a New Threat Hunting Rule?

While this YARA rule is not intended for detection purposes, it can play an important role in threat hunting workflows. It can help reinforce an investigative hypothesis, generate alerts for suspicious files that may be creeping into your environment, and provide early indicators of potential compromise. Additionally, it can aid in identifying related or derivative malware, support retrohunting scans against historical data, and contribute in building a broader picture of an adversary’s tactics, techniques, and procedures (TTPs).

By integrating such rules into regular hunting activities, organizations can strengthen their overall security posture, improve threat visibility, and accelerate incident response.

 

rule Hunt_DarkCloud_Stealer_Variants {
 meta:
   author = "Evelyne Diaz Araque ([email protected])"
   description = "Hunts for DarkCloud stealer samples, variants, or otherwise artifacts with similar capabilities."
   date = "2025-08-10"

 strings:
   $s0 = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Foxmail.url.mailto\\Shell\\open\\command\\"  wide
   $s1 = "?Mon Jul 28 00:35:10"  ascii
   $s2 = "~-mj%08X7a"  ascii
   $s3 = "]tEf{z4`"  ascii
   $s4 = ".o9uf1l "  ascii
   $s5 = "SELECT a11,length(a11) FROM nssPrivate"  wide
   $s6 = "2337203685477580?VNAd"  ascii
   $s7 = "-./01234$556"  ascii
   $s8 = "s\\mslib14&"  ascii
   $s9 = "ComputeHash_2"  wide
   $s10 = "rfBw l` .p8/"  ascii
   $s11 = "4PD;QL|3|"  ascii
   $s12 = "y}+0X2q6.20s)?k"  ascii
   $s13 = "C:\\Users\\Public\\Libraries\\vbsqlite3.dll"  wide ascii

   $d0 = "DARKCLOUD" fullword ascii
   $d1 = "DarkCloud Credentials" fullword ascii
   $d2 = "DarkCloud Gecko Recovery" fullword ascii
   $d3 = "DarkCloud CryptoWallets" fullword ascii
   $d4 = "DarkCloud FilesGrabber" fullword ascii
   $d5 = "DarkCloud Keylogger" fullword ascii

   $t0 = "FROM moz_cookies" fullword ascii
   $t1 = "FROM identities" fullword ascii
   $t2 = "FROM contacts" fullword ascii
   $t3 = "FROM logins" fullword ascii
   $t4 = "FROM credit_cards" fullword ascii
   $t5 = "FROM cookies" fullword ascii
  
   $c0 = "Linq4you"  ascii
   $c1 = "f800001deriv1"  ascii
   $c2 = "decryptF800001"  ascii
   $c3 = "f800001deriv2"  ascii
   $c4 = "$dc45d2c4-49e9-47cd-b267-3740ba204b28"  ascii
   $c5 = "decryptedusername"  ascii

 condition:
   6 of ($s*) or
   (any of ($d*) and 3 of ($t*)) or
   4 of ($c*)
}

Yara Scanning at Scale With Stairwell

Stairwell customers have this YARA rule continuously running over all their files. A major differentiator of Stairwell is that over 100,000 YARA rules are continuously run at scale over every file in our data lake. Unlike other solutions that charge additional fees per rule and per scan, Stairwell’s YARA scanning at scale is included with unlimited usage for customers.

Background pattern