DarkGate

DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.^[2]

DarkGate can masquerade as pirated media content for initial delivery to victims.^[1]

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.^[1]

DarkGate edits the Registry key HKCU\Software\Classes\mscfile\shell\open\command to execute a malicious AutoIt script.^[1] When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.

DarkGate installation includes binary code stored in a file located in a hidden directory, such as shell.txt, that is decrypted then executed.^[1] DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API CallWindowProc() to decode and then execute.^[2]

DarkGate will search for cryptocurrency wallets by examining application window names for specific strings.^[1] DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.^[1]

DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.^[2]

DarkGate can deploy follow-on ransomware payloads.^[1]

DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.^[1]

Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.^[1]

DarkGate uses NirSoft tools to steal user credentials from the infected machine.^[1] NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.

DarkGate uses the native Windows API CallWindowProc() to decode and launch encoded shellcode payloads during execution.^[2] DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution.^[1]

DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.^[2]

DarkGate queries system locale information during execution.^[1] Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.^[2]

DarkGate uses the Delphi methods Sysutils::DiskSize and GlobalMemoryStatusEx to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.^[1] DarkGate will gather various system information such as display adapter description, operating system type and version, processor type, and RAM amount.^[1]

DarkGate can delete system restore points through the command cmd.exe /c vssadmin delete shadows /for=c: /all /quiet".^[1]

DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename.^[1] DarkGate queries victim system epoch time during execution.^[1] DarkGate captures system time information as part of automated profiling on initial installation.^[2]

DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.^[1]

DarkGate checks the BeingDebugged flag in the PEB structure during execution to identify if the malware is being debugged.^[2]

DarkGate can deploy payloads capable of capturing credentials related to cryptocurrency wallets.^[1]

DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server.^[1] DarkGate uses Windows Batch scripts executing the curl command to retrieve follow-on payloads.^[2]

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.^[1]

DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.^[1]

DarkGate command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.^[2]