Darkvnc

Overview

HackTool:Win32/Darkvnc is an incredibly dangerous and specialized Remote Access Trojan (RAT) component. It is a highly customized, stealthy implementation of the Virtual Network Computing (VNC) protocol. Unlike legitimate remote administration tools (like TeamViewer or AnyDesk), DarkVNC is designed to establish a *hidden secondary desktop session* (`T1021.005`) on the victim's machine, allowing an attacker full, interactive graphical control without the legitimate user ever knowing they are being watched.

Understanding DarkVNC (Stealth Remote Access)
To an end-user, DarkVNC is completely invisible; their screen does not flicker, and their mouse does not move on its own. For a security analyst, a DarkVNC detection indicates an advanced, active compromise. DarkVNC is rarely distributed on its own; it is almost always a premium module integrated into high-end Banking Trojans (like Trickbot, IcedID, or Ursnif) and Ransomware affiliate toolkits (like Cobalt Strike deployments).

Execution and Hooking Mechanics
Once the primary malware (e.g., IcedID) compromises the system (`T1566.001`), it drops and injects the DarkVNC DLL into a legitimate process (`T1055`). DarkVNC establishes an outbound connection to the C2 server, bypassing inbound firewall rules (`T1105`). When the attacker initiates a session, DarkVNC uses advanced Windows API hooking to create an invisible, secondary desktop environment (`HDESK`). It can capture the screen, inject keystrokes, and interact with banking portals or cryptocurrency wallets directly from the victim's trusted IP address and browser session (`T1539`), completely bypassing geo-fencing and device fingerprinting controls.

Indicators of Compromise & Impact
The impact is total, interactive compromise of the endpoint and the user's active sessions. Network IoCs include persistent, high-bandwidth outbound TCP connections to unknown IP addresses (often over non-standard ports or disguised as HTTPS). Host-based IoCs include EDR alerts for suspicious process injection (especially involving web browsers or `explorer.exe`), the creation of hidden desktop objects in memory, and anomalous API calls related to desktop switching (`SwitchDesktop`).

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DARKVNC {
    meta:
        description = "Detects Darkvnc (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "darkvnc" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Darkvnc Activity
id: 39ad7a8ebf7e59fccc8192adb7b7729f
status: experimental
description: Detects generic indicators of the darkvnc malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*darkvnc*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Isolate the endpoint IMMEDIATELY; the attacker has active, graphical control and can disable security tools or move laterally.
2. Assume all active sessions (banking, email, corporate VPN) on that machine are compromised and immediately revoke those session tokens.
3. Perform a deep memory forensic analysis to locate the injected DarkVNC module and identify the parent process (often a banking trojan).
4. Block the specific outbound C2 IP addresses identified in the network logs.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume the threat is over just because a scheduled scan quarantined a file; if DarkVNC is active in memory, the attacker is still in control.
2. Avoid relying solely on file hashes; DarkVNC modules are typically heavily customized and memory-resident.

References & External Analysis

• Search "darkvnc" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Klozet
• Umqabaxnjogc
• Simda
• Antavmu
• Msidrop

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/darkvnc.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.