DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.3
tool
DarkGate S1111
- Type
- malware
- Platform
- Windows
- Created
- 9 February 2024
- Last modified
- 12 May 2026
DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]
58
TechniquesTop 1%
13
TacticsTop 1%
0
Threat groupsNone recorded
1
Campaignunranked
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference S1111
DarkGate has stolen sitemanager.xml and recentservers.xml from %APPDATA%\FileZilla\ if present.4
DarkGate will search for cryptocurrency wallets by examining application window names for specific strings.5 DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the FindWindow API function.5
DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.7
DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation.8 DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.9
DarkGate can masquerade as pirated media content for initial delivery to victims.10
Standing S1111
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques58Top 1%
100th percentile · None of the 825 ATT&CK software entries has more Enterprise techniques — the highest in the population.
Tactics13Top 1%
100th percentile · None of the 825 ATT&CK software entries has more tactics spanned — the highest in the population.
Threat groups061% tie · 22 values
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
Campaign185% tie · 8 values
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique13.5med26th pct
26th percentile · 74% of 825 ATT&CK software entries have more detection rules per technique.
Tests / technique5
Detection coverage S1111
1726 distinct rules cover the 58 techniques recorded for this tool. The 1988 technique-to-rule mappings resolve to 1726 distinct rules, because one rule can cover several techniques. 1193 Sigma · 533 Splunk.
50 covered by at least one rule8 with no coverage1726 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org