The DarkGate malware, which has evolved into a Malware-as-a-Service (MaaS) offering, has seen significant developments in its distribution and operational tactics. Initially, DarkGate Loader was primarily disseminated via traditional email malspam campaigns, similar to those used by the infamous Emotet malware. However, since June 2023, there has been a notable increase in malspam campaigns involving DarkGate Loader, following its advertisement as a MaaS on popular cybercrime forums.
Telekom Security has identified the DarkGate malware family as being used by various cybercrime groups. These groups rent out the malware to a select group of affiliates, indicating a structured and collaborative approach to its deployment. DarkGate is expected to continue posing a significant threat for years to come.
One of the notable aspects of the DarkGate campaign is its use of instant messaging platforms like Skype and Microsoft Teams to deliver its payload. Between July and September, the campaign, detected by Trend Micro as TrojanSpy.AutoIt.DARKGATE.AA, utilized these platforms to distribute a Visual Basic for Applications (VBA) loader script to victims. This script then downloaded and executed a second-stage payload consisting of an AutoIT scripting language, a tactic that illustrates the malware's evolving approach to infiltration and spread.
The features and capabilities of DarkGate include phone unlocking, total command and control, data dumping, remote access, creation of hidden users, privilege escalation, malware spreading, tracking, defacement, libel, and harassment. This wide range of capabilities showcases DarkGate's versatility and effectiveness as a tool for various malicious activities.
Overall, the continued evolution of the DarkGate Malware-as-a-Service underscores the dynamic nature of cyber threats and the importance of continuous monitoring and updating of cybersecurity measures to protect against such sophisticated and adaptable malware
IoC
SHA256
- fffa5abebf578cfc2200b4856889e397e412e56c5bff0032d2d7565d9286685f
- feeddfb2a7cc4945eaedd8f75907c42ff097252c3e38d7ef2006bd7a191f09ae
- fa0a47360f68f211413d582d2c73035594a9191c2399c52612c940b45402065f
- f8fcf37ab1e391d1809c4b5baf00d669c4263682d99230432c5199bde5914a60
- f1fa42c3d50d4468b9ac3f7e5cdb1160c8f7ed7bbb6e4017859b837dac7e8d93
- f02928ec21ad8c600eef3e3a006581a3af858975cbc2ad29ba3dfdd1a78d3cb9
- e7b76e11101e35c46a7199851f82c69e819a3d856f6f68fa3af0636c3efde0ca
- de2064d4363a3ccbda5518c619f1c803393b0876e349530583a72b1d1643c16a
- da27475894815900fefb9d383de0d255bfa3b7a22927b2912a2d614742b3109c
- d2b24a51e7e12fded160344bbac9ee1a9082b690d0c6f326170ea8a224038215
REFERENCES
- https://otx.alienvault.com/pulse/64f09671ab42514bf1db37a3
- https://otx.alienvault.com/pulse/64ff2147a9c6a0ac000ebf2f
- https://otx.alienvault.com/pulse/6560841a3ac666c2f0862496
TAGS
DarkGate, Malware-as-a-Service, RastaFarEye
No comments:
Post a Comment