'DarkGate' Campaign Targets Europeans with Multiple Payloads

November 16, 2018

A newly discovered malware campaign is targeting users in Europe with various payloads, has a reactive command and control (C&C) system and can remotely control infected machines, enSilo security researchers warn.

Spreading through torrent files, the DarkGate malware can avoid detection by several anti-virus products and is also capable of detonating multiple payloads onto the infected machines, for crypto-currency mining, stealing crypto-coins, and encrypting victim's files (ransomware).

The campaign operators use a C&C infrastructure cloaked in legitimate DNS records from services such as Akamai CDN and AWS, thus being able to avoid reputation-based detection. Their malware can bypass User Account Control (UAC) and can also evade elimination of critical files by several known recovery tools.

Mainly focused on targets in Spain and France, the campaign uses a reactive C&C infrastructure, where human operators react to notifications from infected machines. As soon as the malware reports back activity of interest on an infected machine, such as the presence of crypto wallets, the operators install a custom remote access tool for further operations.

The malware author invested a lot of time into ensuring the threat can evade detection by anti-virus products and continues to improve their creation. The operation appears financially motivated, but, given the threat's ability to install remote access tools, the author might have other motives as well.

The security researchers were able to link DarkGate with the Golroted password stealer, as both use the Nt* API calls for process hollowing and a SilentCleanup schedule task for UAC bypass. Moreover, there are significant code overlaps between the two malware variants.

Distributed via torrent files, the DarkGate malware has a multi-stage unpacking process that starts with an obfuscated VBScript file functioning as a dropper for several files (saved to a hidden folder "C:\{username}").

The malware uses process hollowing to inject and execute malicious code but, if the Kaspersky anti-virus is detected, the code is loaded as part of the shellcode. The final binary copies all files from "C:\{computer_name} " to a new folder under "C:\Program data" and also installs a new key in the registry, to achieve persistence.

As part of the initial connection made to the C&C server, the malware gets the file necessary to start the cryptocurrency mining process. The malware can also search for and steal credentials for a variety of crypto wallets.

The threat contains six hard coded domains that it attempts to connect to upon infection. It also uses DNS records that are similar to legitimate DNS records from Akamai or Amazon, which allows it to avoid unwanted attention.

The malware also includes various anti-VM and user validation techniques, and also checks the infected system for a series of anti-virus products (informing the server on their presence, with the exception of Kaspersky, Trend Micro and IOBIt) and known recovery tools.

DarkGate, the researchers reveal, uses two distinct UAC bypass techniques in an attempt to elevate its privileges. One abuses a scheduled task for DiskCleanup (cleanmgr.exe), while the other one leverages Event Viewer (eventvwr.exe).

The threat can log keystrokes, and attempts to steal passwords from various programs, using the following applications: Mail PassView, WebBrowserPassView, ChromeCookiesView, IECookiesView, MZCookiesView, BrowsingHistoryView, and SkypeLogView.

DarkGate can delete all restore points on the system, and also appears capable of installing a RDP connection tool, thus providing operators with unfettered access to the infected machine. The server can request various information on the machine, such as locale, username, computer name, processor type, RAM, OS type and version, Epoch time, and installed AV type, among others.