DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]
58
TechniquesTop 1%
13
TacticsTop 1%
0
Threat groupsNone recorded
1
Campaignunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
DarkGate will search for cryptocurrency wallets by examining application window names for specific strings.5DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.5
DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.7
DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation.8DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.9
DarkGate can masquerade as pirated media content for initial delivery to victims.10
Stealth53 detection rules
Standing S1111
Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques58Top 1%
100th percentile · None of the 825 ATT&CK software entries has more Enterprise techniques — the highest in the population.
Tactics13Top 1%
100th percentile · None of the 825 ATT&CK software entries has more tactics spanned — the highest in the population.
Threat groups061% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaign185% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique13.5med26th pct
26th percentile · 74% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique5med42nd pct
42nd percentile · 58% of 825 ATT&CK software entries have more atomic tests per technique.
Data comps / technique4med54% tie · 11 values
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
Mitigations / technique1med57th pct
57th percentile · 57% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this malware’s 58 Enterprise techniques.
Range
Technique Campaign use over its cumulative rule count.
Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.
Detects successful deletion or disabling of an AWS GuardDuty detector, possibly by an attacker trying to avoid detection of its malicious activities. (...)