DarkGate Malware is a complex threat that installs itself in a stealth way and proceeds with many malicious changes to the infected host. Depending on its configuration it may launch various additional threats, steal sensitive data and cause overall system stability problems. In case that you see this program running on your machine, you should remove it before it takes the chance to cause some serious security and privacy related issues.
|Short Description||The application will install itself silently and launch a Trojan horse infection.|
|Symptoms||Performance issues, Inability to run certain services or apps|
|Distribution Method||Email messages and infected payload files|
|Detection Tool|| See If Your System Has Been Affected by DarkGate Malware |
Malware Removal Tool
|User Experience||Join Our Forum to Discuss DarkGate Malware.|
DarkGate Malware — Distribution
The DarkGate malware is a very sophisticated malware that combines the functionality of several different virus types. The attack campaigns primarily target Windows workstations and the attacks themselves are carefully planned to target specific regions or type of users. This shows that careful planning is made by the hacker collectives behind the ongoing attacks.
The security analysis reveals that there are two distinct infection methods behind the DarkGate malware. The common characteristic is that they both use the BitTorrent file-sharing network to spread infected files.
- Malware Content — One of the detected DarkGate malware attacks used files that were masked as Walkind Dead episodes and other spoofed content. When launched the tv series files will run a VBscript embedded in them to download and run the main malware engine.
- Email Phishing Messages — DarkGate malware strains have been found in email scam messages that use the most popular phishing tactics. Distinct campaigns that are confirmed to include the various courier delivery notification scams, a popular example is the one associated with theDHL scam campaign.
After the DarkGate malware is downloaded onto the victim system it will unpack itself in a multi-stage fashion. This is done by a series of obfuscated scripts and files, this procedure is required in order to hide itself from operating system services and security software. The analysis of this behavior shows that it copies itself to system folders and may replace legitimate system data.
DarkGate Malware — Capabilities
During the unpack stages the DarkGate malware will initiate a stealth bypass function. This is done by scanning the system for the presence of anti-virus software or firewalls that can block the virus’s correct execution. Updated versions of it can scan for signatures and registry values as well, not only default installation folders. During the analysis we have detected that a distinct characteristic is the detection of virtual machines, recovery tools or sandbox environments that are used by analysts. If such hosts and engines are found running during the scan they will be disabled and the DarkGate malware may automatically delete itself to avoid detection. Another behavior pattern would be to relocate and rename the virus file so that it doesn’t get detected by the usual virus signature scans.
A list of the found anti-virus signatures identified in the captured samples is the following:
Avast, Kaspersky, AVG, NOD32, BitDefender, Avira, Norton, Trend Micro, ByteFence, Panda,
Search & Destroy, McAfee, Windows Defender, SUPER AntiSpyware, Comodo, Malware Bytes
When this has finished execution a Trojan instance will be run by setting a local client that establishes a secure connection to a hacker-controlled server. It allows the operators behind it to spy on the users, hijack their data and take over control at any given time. The modular framework has been found to call a keylogger component which will track all user actions (keyboard and mouse events) which will be recorded and sent to the hackers.
The analysis also shows that it runs a data collection component. The acquired samples generate a report of the installed hardware components from which a custom victim ID is made for each host. Other information that can be used for this purpose includes specific operating system variables and user-set settings. Future updates and modifications to the malware engine can include a identity theft module. It will search for strings that can directly expose the victims: their real name, phone number, email address, address and any stored username & password combinations. Most of these engines can access both the operating system, hard drive contents and third-party installed applications. A distinct tactic that is employed during this phase is that the servers use DNS records that appear as very similar to those used by Akamai and Amazon. This makes the malicious traffic difficult to identify during network analysis.
Before launching any further modules the DarkGate malware will initiate a scan which checks if the installed OS is 32 or 64-bit. It will run the built-in compatible version afterwards. To elevate its privileges it uses two distinct User Access Control (UAC) bypass techniques. Consequently it will gain administrative privileges and create many processes of its own making it even harder to detect and remove.
Infected hosts will be very difficult to restore as the engine will be remove system data such as Restore points.
Some of the data that is harvested includes the following:
locale, user name, computer name, window name,
time of last input, processor type, display adapter, RAM amount, OS type and version, user admin,
config.bin encrypted contents, epoch type, anti-virus type
How to Remove DarkGate Malware Infections
In order to remove DarkGate Malware and all its associated files from your PC you should complete all steps listed in the removal that follows. It presents both manual and automatic removal approaches that combined could help you to remove this undesired program in full. The automatic approach could properly locate all potentially harmful files so that you could access and remove them easily.
In case that you have further questions or need additional help, don’t hesitate to leave a comment or contact us via email.