Deep Dive: Darkgate (Loader)
Today we are analyzing the Darkgate malware family, which falls under the Loader category.
Overview
DarkGate is an advanced loader and remote access trojan (RAT) that first appeared in 2017 but saw a massive surge in activity during 2023 after being advertised on cybercrime forums. Written in Delphi, it is known for its complex evasion techniques, including abusing AutoIt scripts and DLL hijacking. It typically spreads via phishing emails and malicious links (often utilizing Microsoft Teams or Skype). Once installed, it provides attackers with full remote access, keylogging, cryptocurrency mining, and the ability to deploy additional payloads such as ransomware.
Known Aliases
Security vendors and researchers may refer to this family by several different names, including:
DarkGate LoaderDarkGate RAT
MITRE ATT&CK Techniques
This family has been observed utilizing the following techniques:
- T1566.001: View on MITRE
- T1059.003: View on MITRE
- T1056.001: View on MITRE
- T1105: View on MITRE
Frequently Asked Questions
What is DarkGate?
DarkGate is a sophisticated malware family that operates primarily as a loader and remote access trojan (RAT), providing attackers with remote control over infected systems and the ability to download further malware.
How is DarkGate typically distributed?
It is most commonly distributed through sophisticated phishing campaigns, including malicious emails with attached PDFs or URLs, and sometimes via compromised Microsoft Teams or Skype accounts sending malicious links.
What are the main features of DarkGate?
Its capabilities include keylogging, credential theft, hidden VNC (virtual network computing) for remote control, cryptocurrency mining, and downloading/executing secondary payloads.
This article is part of the Malware Families Catalog. Visit the original page for more details and interactive data! You can also find the full dataset and source code on GitHub, Hugging Face and Kaggle.
Top comments (0)