DarkGate Malware Activity Spikes as Developer Rents Out Malware to Affiliates

A new malspam marketing campaign has been noticed deploying an off-the-shelf malware termed DarkGate.

“The present-day spike in DarkGate malware action is plausible given the fact that the developer of the malware has not long ago started out to rent out the malware to a restricted range of affiliate marketers,” Telekom Security stated in a report revealed last week.

The most current conclusions develop on modern conclusions from security researcher Igal Lytzki, who thorough a “superior quantity marketing campaign” that leverages hijacked email threads to trick recipients into downloading the malware.

The attack commences with a phishing URL that, when clicked, passes via a site visitors way procedure (TDS) to just take the sufferer to an MSI payload issue to specific conditions. This includes the presence of a refresh header in the HTTP response.

Opening the MSI file triggers a multi-stage process that incorporates an AutoIt script to execute shellcode that functions as a conduit to decrypt and start DarkGate by means of a crypter (or loader).

Exclusively, the loader is designed to parse the AutoIt script and extract the encrypted malware sample.

An alternate variation of the attacks have been observed working with a Visual Fundamental Script in put of an MSI file, which, in flip, employs cURL to retrieve the AutoIt executable and script file. The actual process by which the VB Script is shipped is now unidentified.

DarkGate, bought predominantly on underground community forums by an actor named RastaFarEye, comes with capabilities to evade detection by security computer software, established up persistence working with Windows Registry alterations, escalate privileges, and steal details from web browsers and other software package this sort of as Discord and FileZilla.

It also establishes make contact with with a command-and-manage (C2) server for enumerating files, facts exfiltration, launching cryptocurrency miners, and remotely capturing screenshots as properly as functioning other instructions.

The malware is presented as a membership that starts off from $1,000 for each working day to $15,000 for each thirty day period to $100,000 a 12 months, with the author advertising it as the “supreme instrument for pentesters/redteamers” and that it has “characteristics that you is not going to locate anyplace.” Apparently, earlier versions of DarkGate also arrived equipped with a ransomware module.

Phishing attacks are a principal shipping pathway for stealers, trojans, and malware loaders these kinds of as KrakenKeylogger, QakBot, Raccoon Stealer, SmokeLoader, and some others, with danger actors continuously introducing new functions and enhancements to broaden their functionalities.

According to a new report published by HP Wolf Security, email remained the leading vector for delivering malware to endpoints, accounting for 79% of threats recognized in Q2 2023.

Discovered this report interesting? Abide by us on Twitter  and LinkedIn to go through extra special written content we submit.

Some components of this posting are sourced from:
thehackernews.com