DarkGate is a sophisticated Remote Access Trojan sold as Malware-as-a-Service by the actor RastaFarEye, evolving through multiple versions with advanced evasion and multi-stage loading chains. Trellix researchers document its deployment methods, feature set, and global C2 infrastructure, highlighting ongoing development and attempts to bypass security controls. #DarkGate #RastaFarEye #Musarubra #Trellix #SkyhighSecurity
Keypoints
- DarkGate is a MaaS RAT developed by the underground actor RastaFarEye, offered on forums for up to $15,000 per month with continual development since 2017.
- Versions 4.x through 5.x show rapid evolution including extensive evasion, C2 capabilities, and modules for credential theft, keylogging, screen capture, and more.
- Delivery commonly uses phishing emails; recent campaigns also targeted collaboration platforms like Microsoft Teams, delivering a ZIP with LNK files masquerading as PDFs.
- DarkGate employs multi-stage infection chains (VBS/MSI initial stages; AutoIt loaders; in v5, DLL side-loading and enhanced shellcode loaders) executed in memory.
- Evasion and anti-analysis techniques include packers, custom string encoding, anti-VM checks, PPID spoofing, and Kaspersky/EDR bypass mechanisms.
- Global C2 infrastructure, with multiple IPs and domains; Trellix provides IoCs and detection guidance via IVX and related mappings.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The initial access vector via phishing emails that distribute the infection vector. “DarkGate campaigns primarily leverage phishing emails containing links to distribute the initial infection vector.”
- [T1566.002] Phishing: Spearphishing Link – Follow-on spearphishing where links deliver the payload, including a Teams-based lure described in the article.
- [T1059.003] Command and Scripting Interpreter: Windows Command Shell – The infection chain uses a Windows batch script to download and execute payloads, including a VBS script and CScript.exe execution. “Windows Batch script … execute it.”
- [T1059.001] Command and Scripting Interpreter: PowerShell – Indirectly supported via loader activities that fetch and run scripts and payloads via command interpreters.
- [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – DarkGate uses Startup folder copies and Run keys for persistence. “will create a copy of itself in the Startup folder … Run.”
- [T1055.012] Process Injection: Process Hollowing – Variant uses process hollowing to hide and run the malicious payload. “Create suspended process and NtGetContextThread call used to achieve Process Hollowing.”
- [T1574.002] Hijack Execution Flow: DLL Side-Loading – DarkGate v5 uses DLL side-loading with a trojanized DLL (KeyScramblerE.dll) to run code. “KeyScrambler application loads a trojanized DarkGate version of ‘KeyScramblerE.dll’.”
- [T1027.007] Masquerading: Masquerade File Type / [T1036.007] Masquerading: Double File Extension – The malware uses double extensions like “.pdf.lnk” to masquerade as legitimate files. “masquerade a PDF file using the double extension method, ‘.pdf.lnk’.”
- [T1132.002] Data Encoding: Non-Standard Encoding – DarkGate uses custom Base64 alphabets and later, non-ASCII encodings to hinder analysis. “This encoding follows the same approach, a Base64 encoding with custom alphabets.”
- [T1219] Remote Access Software – DarkGate is presented as a RAT with comprehensive remote control features. “DarkGate is a complete toolkit that provides attackers with extensive capabilities to fully compromise victim systems.”
- [T1071.001] Application Layer Protocol: Web Protocols – C2 communications over web protocols and centralized command and control channels. “C2 servers … Web Protocols.”
- [T1005] Data from Local System / [T1113] Screen Capture – DarkGate captures data and screens as part of its data collection.
Indicators of Compromise
- [IP] C2 servers – 80.66.88.145, 5.188.87.58
- [IP] Additional C2 endpoints – 185.8.106.231, 89.248.193.66
- [Domain] C2/domains – bikeontop.shop, xfirecovery.pro
- [Domain] Additional domains – naserviceebaysmman.shop, private-edinmarketing.com
- [SHA256] Sample hashes – 6750f31ef5e1fe74c1121b0ab1308f93e09505a63322b6ce16fe04099ce8993e, 74729d4569691daf72e23849e91461471411f551639663e11e1091a48790611e
- [SHA256] Additional hash – bec37877e3bffa222efb5c5680c7defd2d917317293d7fa70e0882ad45290a40
- [MD5] Sample hash – 63f9b76e4bf4983e13eba7e22dd22781
- [DLL] Hash of a DLL file used in DLL side-loading – 92372f91137114704b5c7cc10882eced9636997486832c5504551e2ba894cb34
- [Shellcode] Hash of shellcode payloads – 3a543dbe70ef5fc78e2fd8b2752e36892f705fc56c54837e248611941dea49c1