DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates

A new malspam campaign has been observed deploying an off-the-shelf malware termed DarkGate.

“The latest spike in DarkGate malware action is plausible presented the actuality that the developer of the malware has recently started out to rent out the malware to a limited quantity of affiliate marketers,” Telekom Security mentioned in a report published final week.

The most recent report develop onn the latest conclusions from security researcher Igal Lytzki, who in-depth a “high volume campaign” that leverages hijacked email threads to trick recipients into downloading the malware.

The attack commences with a phishing URL that, when clicked, passes by way of a traffic route method (TDS) to acquire the victim to an MSI payload matter to certain disorders. This incorporates the presence of a refresh header in the HTTP response.

Opening the MSI file triggers a multi-stage course of action that incorporates an AutoIt script to execute shellcode that functions as a conduit to decrypt and launch DarkGate by way of a crypter (or loader).

Especially, the loader is built to parse the AutoIt script and extract the encrypted malware sample.

An alternate variation of the attacks have been noticed utilizing a Visual Standard Script in position of an MSI file, which, in turn, takes advantage of cURL to retrieve the AutoIt executable and script file. The actual system by which the VB Script is sent is at the moment unidentified.

DarkGate, sold mainly on underground discussion boards by an actor named RastaFarEye, will come with capabilities to evade detection by security software, established up persistence using Windows Registry changes, escalate privileges, and steal knowledge from web browsers and other application these kinds of as Discord and FileZilla.

It also establishes make contact with with a command-and-manage (C2) server for enumerating documents, knowledge exfiltration, launching cryptocurrency miners, and remotely capturing screenshots as well as running other instructions.

The malware is presented as a subscription that commences from $1,000 for each day to $15,000 for every month to $100,000 a yr, with the writer marketing it as the “ultimate tool for pentesters/redteamers” and that it has “features that you will never come across everywhere.” Apparently, previously variations of DarkGate also arrived equipped with a ransomware module.

Phishing assaults are a major shipping and delivery pathway for stealers, trojans, and malware loaders these types of as KrakenKeylogger, QakBot, Raccoon Stealer, SmokeLoader, and some others, with risk actors consistently incorporating new features and enhancements to broaden their functionalities.

According to a modern report published by HP Wolf Security, email remained the best vector for providing malware to endpoints, accounting for 79% of threats discovered in Q2 2023.

Found this article interesting? Observe us on Twitter  and LinkedIn to browse extra exclusive content we post.

Some parts of this article are sourced from:
thehackernews.com