Executive Summary
DarkWatchman is a highly elusive Remote Access Trojan (RAT) typically delivered via phishing emails containing a WinRAR SFX dropper. The malware is characterized by its fileless operation, as it resides primarily in the Windows Registry and memory rather than as a standalone executable on disk. Recent analysis (v103.9.1) reveals a multi-stage infection chain that utilizes a combination of JavaScript loaders and C# keyloggers compiled on the fly on the victim's machine.
The attack chain involves a WinRAR SFX dropper that presents a fake extraction interface while silently executing a JavaScript loader. This loader uses WMI and PowerShell to establish persistence via hidden scheduled tasks and store encrypted configurations in the Registry under the Desktop Window Manager (DWM) key. DarkWatchman's capabilities include keylogging, screen captures, credential theft, and remote command execution, making it a severe threat for long-term data exfiltration.