{
  "name": "Disarming DarkGate: A Deep Dive into Thwarting the Latest DarkGate Variant",
  "slug": "disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant",
  "description": "This report analyzes a recent phishing campaign distributing a new DarkGate Remote Access Trojan variant. The malware leverages various obfuscation and anti-analysis techniques, including process hollowing, anti-VM checks, and encoding. It supports numerous malicious functionalities like ransomware, credential theft, remote control, and system disruption, controlled by a command-and-control server. The analysis provides in-depth technical details on the malware's execution flow, anti-detection mechanisms, and command handling.",
  "published": "2024-07-15T13:14:48+00:00",
  "created_at": "2024-07-15T13:14:48+00:00",
  "modified_at": "2024-07-15T13:27:09+00:00",
  "created_at_opencti": "2024-07-15T13:14:48+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-07-15",
    "darkgate",
    "rat"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "83f1fab236357817270f995a6e3e32f90661dad6d625ad1e1f16b06c248da1d1"
      },
      {
        "id": "",
        "name": "6c8e82b582f55a03277427e757331e5aa53dcf6656785dcb44f2958ef5516863"
      },
      {
        "id": "",
        "name": "49a46f2ff414ad11b2b623a7dc811002bf78979b5db1fb6f03334fd1fa20f8a6"
      },
      {
        "id": "",
        "name": "0a3764e9972dcdd3819f4728038d094a28a1ccff43d7d9e413eab794c9ecbe05"
      }
    ],
    "malware": [
      {
        "id": "9859dba4-182b-4ce5-aa4d-c0768b9b15a7",
        "name": "DarkGate",
        "slug": "darkgate"
      }
    ],
    "attack_patterns": [
      {
        "id": "abbc175c-5c50-4025-96d8-505bc7cda420",
        "name": "T1563.002"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "9322d33b-00c1-4f99-9f1a-a33d93c0dac2",
        "name": "T1059.007"
      },
      {
        "id": "32817170-4c07-427e-b8a5-80a733ae2550",
        "name": "T1497"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "d9f271ed-7685-4362-b90d-f16a14102f39",
        "name": "T1489"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "747c7b95-79ff-4132-8ea5-397cb6665ebd",
        "name": "T1498"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://blog.sonicwall.com/en-us/2024/07/disarming-darkgate-a-deep-dive-into-thwarting-the-latest-darkgate-variant/",
    "https://otx.alienvault.com/pulse/66953ce8e8b337e9591be5a9"
  ]
}