DarkGate Loader

DarkGate Loader

x64 Delphi Loader unleashed by GreetingGhoul

A comprehensive analysis has been conducted on a widespread phishing campaign that has been targeting individuals globally over the past month. The culmination of this campaign’s execution chain results in the deployment of a malware known as DarkGate, which is classified as a loader-type malware.

Summary

It is noteworthy that DarkGate is exclusively distributed through underground online forums, with the developer maintaining strict control over the number of available licenses. The threat actors behind this campaign have employed a high-volume distribution strategy, utilizing stolen email conversation threads to which they had gained access. This approach exploits the tendency of users to trust familiar communication patterns, potentially leading to infection among those unaware of such sophisticated social engineering tactics.

The campaign’s execution flow can be summarized as follows:

1. Geofence Check: The exact parameters for passing the geofence set by the threat actors remain under investigation. Analysis of successful payload retrievals on URLscan.io revealed the presence of a refresh header in the response, containing the URL for payload download.
   
2. MSI Loader: Upon successful geofence clearance, an MSI file is downloaded, following the naming convention: Project_[0-9]{7}.msi. This MSI file contains two embedded components:
   
   • CustomAction.dll
   • WrappedSetupProgram.cab
     
3. AutoIT Script: The CustomAction.dll is responsible for unpacking and executing the contents of WrappedSetupProgram.cab, which includes:
   
   • Autoit3.exe
   • UGtZgHHT.au3 (AutoIT 3 script)
     
     
4. Shellcode Injection: The AutoIT script performs two primary functions:
   
   • Concatenation of segmented hex-encoded shellcode
     
   • Injection and execution of the shellcode
     
     
5. Loader Analysis: The extracted loader is responsible for decoding and executing portions of the data stored within the AutoIT script, ultimately revealing the DarkGate loader.
6. DarkGate Analysis: The final payload, DarkGate, incorporates various capabilities, including:
   
   • HVNC (Hidden Virtual Network Computing)
   • Cryptocurrency miner setup
   • Browser history and cookie theft
   • Remote Desktop Protocol (RDP) functionality
   • HiddenAnyDesk integration

The malware employs sophisticated obfuscation techniques, including custom Base64 encoding and XOR operations, to protect its configuration and network communications. Detailed analysis of these mechanisms has been conducted, and decryption scripts have been developed to facilitate further investigation.

In conclusion, this campaign demonstrates a high level of sophistication in its execution, combining social engineering tactics with advanced malware deployment techniques. The multi-stage nature of the attack, coupled with the use of legitimate-looking components and complex obfuscation methods, underscores the evolving landscape of cyber threats and the need for continued vigilance and advanced detection capabilities.

Objective

• Assess the dangers and capabilities of the submitted Sample & C2 platform
• Uncover HiddenAnydesk Methodology to submit for patch
• Provide extracted, de-obfuscated Loading method (AutoIT)

Anydesk Invoke Script Extracted (Deobfuscated)