Procedure examples

DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.

DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.

DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.

DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation. DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.

DarkGate can masquerade as pirated media content for initial delivery to victims.

DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the C:\\ root directory that copies and renames the legitimate Windows <curl>curl</code> command to this new location.

DarkGate masquerades malicious LNK files as PDF objects using the double extension .pdf.lnk.

DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.

DarkGate has used WMI to execute files over the network and to obtain information about the domain.

DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.

DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.

DarkGate has used PowerShell to create a remote shell.

DarkGate uses a malicious Windows Batch script to run the Windows code utility to retrieve follow-on script payloads. DarkGate has also used `cmd.exe` to create a remote shell.

DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.

DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.

DarkGate has deleted its staging directories.

DarkGate can cloak command and control traffic in DNS records from legitimate services to avoid reputation-based detection techniques.

DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.

Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.

DarkGate elevates accounts created through the malware to the local administration group during execution.

DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server. DarkGate uses Windows Batch scripts executing the curl command to retrieve follow-on payloads. DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

DarkGate uses the native Windows API CallWindowProc() to decode and launch encoded shellcode payloads during execution. DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution. DarkGate has also used the `CreateToolhelp32Snapshot`, `GetFileAttributesA` and `CreateProcessA` functions to obtain a list of running processes, to check for security products and to execute its malware.

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.

DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.

DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.

DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.

DarkGate creates a local user account, SafeMode, via net user commands.

DarkGate installation includes binary code stored in a file located in a hidden directory, such as shell.txt, that is decrypted then executed. DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API CallWindowProc() to decode and then execute.

DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution. DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.

DarkGate can deploy follow-on ransomware payloads.

DarkGate can delete system restore points through the command cmd.exe /c vssadmin delete shadows /for=c: /all /quiet”.

DarkGate can deploy follow-on cryptocurrency mining payloads.

DarkGate queries system resources on an infected machine to identify if it is executing in a sandbox or virtualized environment.

DarkGate looks for various security products by process name using hard-coded values in the malware. DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.

DarkGate has used the `shutdown`command to shut down and/or restart the victim system.

DarkGate attempts to steal Opera cookies, if present, after terminating the related process.

DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder. DarkGate installation finishes with the creation of a registry Run key.

DarkGate uses two distinct User Account Control (UAC) bypass techniques to escalate privileges.

DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.

DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.

DarkGate has deleted all files in the Mozilla directory using the following command: `/c del /q /f /s C:\Users\User\AppData\Roaming\Mozilla\firefox*`.

DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name. Additionally, DarkGate uses attrib to hide a directory in the following command: ` C:\Windows\system32\attrib.exe” +h C:/rjtu/`.

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.

DarkGate is distributed in phishing emails containing links to distribute malicious VBS or MSI files. DarkGate uses applications such as Microsoft Teams for distributing links to payloads.

DarkGate tries to elevate privileges to SYSTEM using PsExec to locally execute as a service, such as cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary].

DarkGate edits the Registry key HKCU\Software\Classes\mscfile\shell\open\command to execute a malicious AutoIt script. When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.

DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.