Darkgate campaigns rely on phishing emails to steal access and drop staged payloads, starting with a PDF invoice that prompts users to install Java and click a link. The clicking leads to a geofenced URL that downloads a malicious JAR, which digital-forwards additional payloads and increasingly hides its operations with obfuscated AutoIt code and in-memory shell techniques. #Darkgate #QakBot #IntuitQuickbooks #AutoIt #Forcepoint #PowerShell
Keypoints
- Darkgate propagates primarily via phishing emails, hijacking accounts and distributing malicious attachments (XLSX, HTML, PDF).
- The campaign uses an invoice-like lure from “Intuit Quickbooks” in PDF format to entice victims to install Java and follow a link.
- Clicking the embedded link redirects to a geofenced URL that initiates the download of a malicious JAR (Java Archive) payload.
- Dynamic analysis of the JAR reveals a class file that downloads a ZIP to C:Downloads via a obfuscated curl.exe command, then triggers PowerShell to expand the archive.
- The ZIP contains AutoIt components (autoit3.exe and a compiled .a3x script); the JAR executes an obfuscated cmd /c to run the AutoIt script.
- Decompiled AutoIt code shows obfuscation (BITXOR, BinaryToString) and in-memory shell code plus memory structures to interact with system resources and connect to a remote C2 server.
MITRE Techniques
- [T1566.002] Spearphishing Link – The campaign commences with an attack via a compromised email, featuring an invoice purportedly from ‘Intuit Quickbooks’ in PDF format. It prompts users to install Java to view the invoice, providing a link. Upon clicking the link, users are redirected to a geofenced URL where they inadvertently download the subsequent stage payload. “…prompt users to install Java to view the invoice, providing a link. Upon clicking the link, users are redirected to a geofenced URL where they inadvertently download the subsequent stage payload.”
- [T1566.001] Spearphishing Attachment – Phishing emails with malicious attachments (PDF in this case) are used to initiate the infection chain. “…phishing emails. By hijacking email accounts, distributing malicious attachment…”
- [T1105] Ingress Tool Transfer – The hyperlink in the PDF triggers the download of a malicious .jar (Java Archive) file. “…download of a malicious .jar (Java Archive) file.”
- [T1059.001] PowerShell – The ZIP extraction is performed using the ‘expand-archive’ command via PowerShell. “…PowerShell to extract its contents using the ‘expand-archive’ command.”
- [T1027] Obfuscated/Compressed Files and Information – The AutoIt script contains obfuscated functions (BITXOR, BinaryToString) to conceal functionality. “…obfuscated AutoIt functions such as BITXOR and BinaryToString(), which are employed to obscure the script’s functionality.”
- [T1059.003] Windows Command Shell – The compiled AutoIt script is launched via an obfuscated ‘cmd /c’ command. “…compiled AutoIt script. Subsequently, the JAR file executes an obfuscated ‘cmd /c’ command to run this compiled AutoIt script.”
- [T1071] Command and Control – The in-memory shell code ultimately communicates with a remote C2/botnet server. “…shell code in memory and perform connection with remote C&C botnet server.”
Indicators of Compromise
- [Domain] Initial-stage domains – afarm.net, affixio.com
- [Domain] Additional initial-stage domains – affiliatebash.com, afcmanager.net
- [Domain] C2 domain – kindupdates.com
- [Domain] Second-stage URL domain – smbeckwithlaw.com
- [File] PDF name – may-document_[number].pdf
- [File] ZIP payload – 1.zip
Read more: https://www.forcepoint.com/blog/x-labs/phishing-script-inside-darkgate-campaign