DarkCloud Infostealer — Commercial VB6 Credential-Harvesting Malware (A310Logger/BluStealer Successor) — Threadlinqs Intelligence
As of 2026-06-10, DarkCloud Infostealer — Commercial VB6 Credential-Harvesting Malware (A310Logger/BluStealer Successor) is a high-severity malware threat attributed to Darkcloud Coder, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 44 indicators of compromise.
Threat ID: TL-2026-0765 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Darkcloud Coder · FINANCIAL
DarkCloud is a commercially sold Windows infostealer, first observed in 2022 and written in Visual Basic 6.0, that performs high-volume credential harvesting and structured data exfiltration across
DarkCloud is a subscription-based ('malware-as-a-service') Windows infostealer marketed since 2022 by an actor known as 'Darkcloud Coder' (previously the Telegram handle 'BluCoder'), and is the lineal successor to the A310Logger/BluStealer family — a link established through matching regular-expression and exfiltration code patterns. The final-stage stealer is compiled from Visual Basic 6.0 to native code and depends on the legacy MSVBVM60.DLL runtime; the VB6 lineage materially lowers detection rates relative to functionally equivalent C/C++ samples in multi-engine scanning.
The malware has used several distinct delivery and obfuscation chains. Earlier 2025 campaigns documented by Unit 42 delivered DarkCloud via phishing emails carrying RAR archives or decoy PDFs (a fake 'Adobe Flash Player' update lure) that lead to an AutoIt-compiled dropper. The AutoIt script carries two embedded blobs — 'iodization' (a shellcode container) and 'plainstones' (an XOR-encrypted PE) — extracts shellcode at offset 0x23D0, flips memory to PAGE_EXECUTE_READWRITE via VirtualProtect(), and runs it through CallWindowProc(); the shellcode decrypts and runs the VB6 payload in memory. A newer chain replaces AutoIt with obfuscated JavaScript/WSF retrieved from open directories, which pulls AES+Base64-encrypted PowerShell that drops a ConfuserEx-protected .NET loader; that loader injects the VB6 stealer into RegAsm.exe via process hollowing (RunPE).
Internally, DarkCloud encrypts most strings to frustrate static and dynamic analysis. Older variants use a layered scheme built on Visual Basic's Rnd() PRNG with a custom deterministic seed-reset algorithm, hex-encoded ciphertext and Base64-encoded keys; recent variants encrypt critical strings — regular expressions, registry paths, file extensions and Telegram API credentials — with RC4 using a unique key per ciphertext. The stealer enumerates analysis tooling (WinDbg, Fiddler, TCPView, Process Explorer, Process Monitor, Wireshark, VMware Tools) before executing.
Collection covers Chromium- and Gecko-based browsers (Chrome, Edge, Firefox, Brave, Opera, Yandex, Vivaldi) for saved logins, cookies and credit-card data; email clients (Outlook, eM Client, FoxMail, Thunderbird, 163Mail, MailMaster) for stored passwords and contacts; FTP clients (FileZilla, WinSCP, CoreFTP); plus Pidgin and NordVPN credentials. It also captures screenshots, host/username system information, and keystrokes via a secondary keylogger component. Staged data is written under %APPDATA%\Microsoft\Windows\Templates (a 'DBS' folder for copied databases and a '_' folder for parsed plaintext) before exfiltration over SMTP (TLS, hostname/username embedded in the subject, data as attachments), FTP, the Telegram Bot API, and HTTP — all using credentials hardcoded per build. Since early 2025 the operation has shown a marked surge against financial-sector organizations, with activity peaking in August 2025.
Weaknesses (CWE)
CWE-522, CWE-256, CWE-319
Target sectors: financial, banking, government, technology, manufacturing
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 44 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1566, T1204, T1059, T1059, T1059, T1106, T1053, T1547, T1027, T1140