Saturday, May 18, 2024

DarkGate Gained Popularity for its Covert Nature and Antivirus Evasion

DarkGate, a sophisticated Malware-as-a-Service (MaaS) offered by the enigmatic RastaFarEye persona, has surged in prominence.

The malware is known for abusing Microsoft Teams and MSI files to compromise target systems. 

This Sekoia report delves into its ominous capabilities, examining its deployment by threat actors like TA577 and Ducktail.

DarkGate employs ingenious data obfuscation techniques, including base64 encoding with a dual-alphabet approach. 

Unraveling its inner workings reveals a TStringList configuration stored in PE, challenging analysts to decode and comprehend.

Free Webinar

Live API Attack Simulation Webinar

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked. The session will cover: an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Command and Control Evasion Tactics

The malware communicates covertly with the attacker’s server over HTTP, employing obfuscated messages. 

A dynamic C2 port strategy and a unique approach to action IDs contribute to DarkGate’s resilient command and control infrastructure.

Darkgate Infection chain

DarkGate unleashes a range of Remote Access Trojan (RAT) tactics, from reverse shell implementations to PowerShell script executions, reads the report.

Its keylogger prowess, Discord token hunting, and remote desktop access through hidden Virtual Network Computing (hVNC) pose significant threats.

The malware employs Union API, dynamic API resolution, and LOLBAS DLL loading to elude traditional antivirus solutions. 

Its APC injection via NtTestAlert further reduces its footprint, while environment detection ensures adaptability to diverse host configurations.

DarkGate exhibits multiple persistence techniques, utilizing LNK files, registry keys, and DLL loading. 

Its privilege escalation methods range from PsExec restarts to raw stub execution, ensuring sustained access to compromised hosts.

Post-Compromission Hunting

Hunting for DarkGate traces unveils a plethora of artifacts, from registry keys to log and debug files. 

Vigilance in monitoring temporary directories and specific file paths is crucial for identifying and mitigating DarkGate infections.

DarkGate’s advanced development and diverse functionalities make it a formidable threat. 

Despite leveraging open-source PoCs and established tools, its unique amalgamation of techniques demands continual scrutiny. 

Organizations must remain vigilant, as DarkGate persists as a significant menace in the cybercrime landscape.

Experience how StorageGuard eliminates the security blind spots in your storage systems by trying a 14-day free trial.


Latest articles

Norway Recommends Replacing SSLVPN/WebVPN to Stop Cyber Attacks

A very important message from the Norwegian National Cyber Security Centre (NCSC) says that...

New Linux Backdoor Attacking Linux Users Via Installation Packages

Linux is widely used in numerous servers, cloud infrastructure, and Internet of Things devices,...

ViperSoftX Malware Uses Deep Learning Model To Execute Commands

ViperSoftX malware, known for stealing cryptocurrency information, now leverages Tesseract, an open-source OCR engine,...

Santander Data Breach: Hackers Accessed Company Database

Santander has confirmed that there was a major data breach that affected its workers...

U.S. Govt Announces Rewards up to $5 Million for North Korean IT Workers

The U.S. government has offered a prize of up to $5 million for information...

Russian APT Hackers Attacking Critical Infrastructure

Russia leverages a mix of state-backed Advanced Persistent Threat (APT) groups and financially motivated...

Millions Of IoT Devices Vulnerable To Attacks Leads To Full Takeover

Researchers discovered four significant vulnerabilities in the ThroughTek Kalay Platform, which powers 100 million...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles