New DarkCloud Campaign Leverages Spam Emails

Diving into details

• The attached file functions as a dropper, responsible for generating and executing DarkCloud and ClipBanker. 
• If users download and execute the decompressed file, it can lead to the theft of various account credentials stored on the compromised system. 
• Furthermore, there is a potential risk of cryptocurrency wallet address substitution, wherein the threat actor's address replaces the user's clipboard content, resulting in funds being sent to the threat actor's wallet during transactions.

Capabilities of DarkCloud 

• DarkCloud is known for pilfering system information, capturing screenshots, monitoring clipboard activities, and extracting other information from the target system.
• The malware operators claim to target Chromium-based and  Firefox-based web browsers and email clients (such as ThunderBird, Outlook, and FoxMail), and FTP client programs (such as CoreFTP and WinSCP).

A bit about ClipBanker

• The specific ClipBanker variant utilized in this attack has been identified as "Get Cliboard Address.exe'' and functions by monitoring the clipboard. 
• Whenever a clipboard entry matches predefined regular expressions, the entry is altered to correspond to the wallet address specified by the threat actor.

The bottom line