DarkCloud Stealer - RunOnce Registry Persistence

Aaron Shelmire@ashelmire

•updated Jun 30, 2025•2•3•33

Detects the creation or modification of a registry key under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, a common persistence mechanism used by DarkCloud Stealer.