Ensilo Darkgate 2018

DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.

DarkGate will search for cryptocurrency wallets by examining application window names for specific strings. DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.

DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation. DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.

DarkGate can masquerade as pirated media content for initial delivery to victims.

DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.

DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.

DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.

DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.

DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.

DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.

DarkGate can cloak command and control traffic in DNS records from legitimate services to avoid reputation-based detection techniques.

DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.

Some versions of DarkGate search for the hard-coded folder C:\Program Files\e Carte Bleue.

DarkGate elevates accounts created through the malware to the local administration group during execution.

DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server. DarkGate uses Windows Batch scripts executing the curl command to retrieve follow-on payloads. DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.

DarkGate uses the native Windows API CallWindowProc() to decode and launch encoded shellcode payloads during execution. DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution. DarkGate has also used the `CreateToolhelp32Snapshot`, `GetFileAttributesA` and `CreateProcessA` functions to obtain a list of running processes, to check for security products and to execute its malware.

DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.

DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.

DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.

DarkGate creates a local user account, SafeMode, via net user commands.

DarkGate installation includes binary code stored in a file located in a hidden directory, such as shell.txt, that is decrypted then executed. DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API CallWindowProc() to decode and then execute.

DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution. DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.

DarkGate can deploy follow-on ransomware payloads.

DarkGate can delete system restore points through the command cmd.exe /c vssadmin delete shadows /for=c: /all /quiet”.

DarkGate can deploy follow-on cryptocurrency mining payloads.

DarkGate queries system resources on an infected machine to identify if it is executing in a sandbox or virtualized environment.

DarkGate looks for various security products by process name using hard-coded values in the malware. DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.

DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder. DarkGate installation finishes with the creation of a registry Run key.

DarkGate uses two distinct User Account Control (UAC) bypass techniques to escalate privileges.

DarkGate uses NirSoft tools to steal user credentials from the infected machine. NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.

DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name. Additionally, DarkGate uses attrib to hide a directory in the following command: ` C:\Windows\system32\attrib.exe” +h C:/rjtu/`.

DarkGate can be distributed through emails with malicious attachments from a spoofed email address.

DarkGate edits the Registry key HKCU\Software\Classes\mscfile\shell\open\command to execute a malicious AutoIt script. When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.

DarkGate overrides the %windir% environment variable by setting a Registry key, HKEY_CURRENT_User\Environment\windir, to an alternate command to execute a malicious AutoIt script. This allows DarkGate to run every time the scheduled task DiskCleanup is executed as this uses the path value %windir%\system32\cleanmgr.exe for execution.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

DarkGate can deploy payloads capable of capturing credentials related to cryptocurrency wallets.

DarkGate uses the Delphi methods Sysutils::DiskSize and GlobalMemoryStatusEx to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.

DarkGate will terminate processes associated with several security software products if identified during execution.