DarkMe RAT: A VB6 APT Trojan Turned Conventional Infostealer

This report analyzes a 2026 DarkMe campaign: phishing emails delivered a .pif executable masquerading as an image which launched msiexec to fetch a remote MSI. A staged installer expanded a CAB and ran a VBScript which registered a COM object and invoked rundll32.exe /sta {CLSID} to start a three-stage VB6 loader chain; the final stage decrypts a payload and hollowed a signed Microsoft clspack.exe to run a VB6 stealer/RAT that targets cryptocurrency wallets, trading and gambling software, captures screenshots, and communicates with C2 on TCP port 7712. The report includes hashes, registry and file IOCs, C2 RC4 keys/domains, infrastructure analysis, and actionable detections and remediation steps (alerts for rundll32 /sta with GUID, remote msiexec /i, .pif execution, suspicious signed binaries running from %AppData%, and removal steps).