MITRE ATT&CKsoftware (malware)
S1111 DarkGate
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2024-02-09
Description
DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions. DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.
Related
Uses · MITRE ATT&CK (58)
- T1685 Disable or Modify Tools technique
- T1680 Local Storage Discovery technique
- T1496.001 Compute Hijacking sub-technique
- T1098.007 Additional Local or Domain Groups sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1059.010 AutoHotKey & AutoIT sub-technique
- T1665 Hide Infrastructure technique
- T1657 Financial Theft technique
- T1622 Debugger Evasion technique
- T1036.007 Double File Extension sub-technique
- T1614 System Location Discovery technique
- T1583.001 Domains sub-technique
- T1071.004 DNS sub-technique
- T1574.001 DLL sub-technique
- T1574.007 Path Interception by PATH Environment Variable sub-technique
- T1574 Hijack Execution Flow technique
- T1204.002 Malicious File sub-technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.001 System Checks sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1561.001 Disk Content Wipe sub-technique
- T1134.004 Parent PID Spoofing sub-technique
- T1056.001 Keylogging sub-technique
- T1555 Credentials from Password Stores technique
Referenced by MITRE ATT&CK · uses (1)
- C0037 Water Curupira Pikabot Distribution campaign