Saturday, December 14, 2024
HomeAnti VirusDarkGate Gained Popularity for its Covert Nature and Antivirus Evasion

DarkGate Gained Popularity for its Covert Nature and Antivirus Evasion

Published on

SIEM as a Service

DarkGate, a sophisticated Malware-as-a-Service (MaaS) offered by the enigmatic RastaFarEye persona, has surged in prominence.

The malware is known for abusing Microsoft Teams and MSI files to compromise target systems. 

This Sekoia report delves into its ominous capabilities, examining its deployment by threat actors like TA577 and Ducktail.

- Advertisement - SIEM as a Service

DarkGate employs ingenious data obfuscation techniques, including base64 encoding with a dual-alphabet approach. 

Unraveling its inner workings reveals a TStringList configuration stored in PE, challenging analysts to decode and comprehend.

Document
Free Webinar

Live API Attack Simulation Webinar

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Command and Control Evasion Tactics

The malware communicates covertly with the attacker’s server over HTTP, employing obfuscated messages. 

A dynamic C2 port strategy and a unique approach to action IDs contribute to DarkGate’s resilient command and control infrastructure.

Darkgate Infection chain

DarkGate unleashes a range of Remote Access Trojan (RAT) tactics, from reverse shell implementations to PowerShell script executions, reads the report.

Its keylogger prowess, Discord token hunting, and remote desktop access through hidden Virtual Network Computing (hVNC) pose significant threats.

The malware employs Union API, dynamic API resolution, and LOLBAS DLL loading to elude traditional antivirus solutions. 

Its APC injection via NtTestAlert further reduces its footprint, while environment detection ensures adaptability to diverse host configurations.

DarkGate exhibits multiple persistence techniques, utilizing LNK files, registry keys, and DLL loading. 

Its privilege escalation methods range from PsExec restarts to raw stub execution, ensuring sustained access to compromised hosts.

Post-Compromission Hunting

Hunting for DarkGate traces unveils a plethora of artifacts, from registry keys to log and debug files. 

Vigilance in monitoring temporary directories and specific file paths is crucial for identifying and mitigating DarkGate infections.

DarkGate’s advanced development and diverse functionalities make it a formidable threat. 

Despite leveraging open-source PoCs and established tools, its unique amalgamation of techniques demands continual scrutiny. 

Organizations must remain vigilant, as DarkGate persists as a significant menace in the cybercrime landscape.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

“Password Era is Ending,” Microsoft to Delete 1 Billion Passwords

Microsoft has announced that it is currently blocking an astounding 7,000 password attacks every...

Over 300,000 Prometheus Servers Vulnerable to DoS Attacks Due to RepoJacking Exploit

The research identified vulnerabilities in Prometheus, including information disclosure from exposed servers, DoS risks...

Reyee OS IoT Devices Compromised: Over-The-Air Attack Bypasses Wi-Fi Logins

Researchers discovered multiple vulnerabilities in Ruijie Networks' cloud-connected devices. By exploiting these vulnerabilities, attackers...

New Android Banking Malware Attacking Indian Banks To Steal Login Credentials

Researchers have discovered a new Android banking trojan targeting Indian users, and this malware...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

“Password Era is Ending,” Microsoft to Delete 1 Billion Passwords

Microsoft has announced that it is currently blocking an astounding 7,000 password attacks every...

Over 300,000 Prometheus Servers Vulnerable to DoS Attacks Due to RepoJacking Exploit

The research identified vulnerabilities in Prometheus, including information disclosure from exposed servers, DoS risks...

Reyee OS IoT Devices Compromised: Over-The-Air Attack Bypasses Wi-Fi Logins

Researchers discovered multiple vulnerabilities in Ruijie Networks' cloud-connected devices. By exploiting these vulnerabilities, attackers...