Executive Summary
DarkCore is a sophisticated C++ remote access trojan (RAT) that focuses on data exfiltration and account takeover through advanced session hijacking. The malware features a unique dedicated browser that allows attackers to inject stolen session cookies and access services like Gmail, WhatsApp, and MediaFire while appearing to originate from the victim's own IP address, effectively bypassing IP-based security controls and multi-factor authentication (MFA).
The attack chain typically begins with a malicious PDF-themed shortcut file (LNK) that uses obfuscated commands to download a decoy document and the primary DarkCore executable. Once active, the RAT provides capabilities for credential theft, file transfers, and hidden virtual network computing (HVNC), which allows an operator to control a hidden Windows desktop invisible to the user.
This threat is particularly significant for enterprises as it directly facilitates Business Email Compromise (BEC) and unauthorized access to cloud storage and messaging platforms. By routing activity through the victim's infrastructure, DarkCore significantly complicates detection efforts that rely on geographical or IP reputation anomalies.