DarkGateMalware
- mehcrypter
First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts.From MISP Galaxy
Last reported 4 months ago, by Sekoia.io4 reports
ATT&CK techniques
5 techniques · each with the sentence it comes from- T1684Social Engineering
“ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims”
- T1036Masquerading
“…s in ClickFix messages displayed to users, such as the phrase “Press the key combination” or “CTRL+V”, we discovered several websites masquerading as the homepage of a Google Meet video conference.”
- T1213.003Code Repositories
“…y targeted developers to spread Lumma Stealer by falsely reporting security vulnerabilities, thereby impacting thousands of public code repositories and exploiting developers’ trust in GitHub notifications.”
- T1219Remote Access Tools
“…, multiple malware distribution campaigns have leveraged the ClickFix lure to spread Windows and macOS infostealers, botnets, and remote access tools.”
- T1564.003Hidden Window
“It executes in a hidden window (-w 1) and bypasses execution policies (-ep Unrestricted).”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
ClickFix tactic: The Phantom Meet Infostealer Campaign“… used HTML files disguised as Word documents, displaying a fake error window that prompts users to install malware such as Matanbuchus, DarkGate, or NetSupport RAT via a PowerShell script.”
-
WebDAV-as-a-Service: The Infrastructure Behind Emmenhtal“Over 100 WebDAV servers delivered a wide range of payloads including DarkGate, Amadey, Lumma, Remcos and many others.”
-
ClickFix: The Social Engineering Technique Hackers Use to Manipulate Victims“The final payload in this campaign was DarkGate malware.”
-
Top 3 Cybersecurity Threats of 2024 (So Far)“…t this year, this shady attack method has actually been part of the toolkit for malware families like Bumblebee, Cicada, BadRabbit, and DarkGate since late 2023.”
Indicators in its reports
named in the reports above- meet.googie.com-join[.]usin 1 report
- meet.google.web-join[.]comin 1 report
- meet.google.cdm-join[.]usin 1 report
- hxxps://meet.google.com-join[.]us/wmq-qcdn-orjin 1 report
- meet.google.com-join[.]usin 1 report
- hxxps://meet.google.us-join[.]com/ywk-batf-sfhin 1 report
- meet.google.us-join[.]comin 1 report
- hxxps://meet.google.us07host[.]com/coc-btru-aysin 1 report
- meet.google.us07host[.]comin 1 report
- hxxps://meet.google.webjoining[.]com/exw-jfaj-hpain 1 report
- meet.google.webjoining[.]comin 1 report
- hxxps://googiedrivers[.]com/fix-errorin 1 report
- googiedrivers[.]comin 1 report
- 92a8cc4e385f170d…bee9e3453138in 1 report
- a834be6d2bec10f3…58df183f773cin 1 report
- 2853a61188b4446b…743b1a44cbfein 1 report
- hxxp://95.182.97[.]58/84b7b6f977dd1c65.php%E2%80%9Din 1 report
- 95.182.97[.]58in 1 report
- hxxp://91.103.140[.]200:9078/3936a074a2f65761a5eb8/6fmfpmi7.fwf4p%E2%80%9Din 1 report
- 91.103.140[.]200in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.