S1111: DarkGate

S1111: DarkGate describes [DarkGate](https://attack.mitre.org/software/S1111) first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, [DarkGate](https://attack.mitre.org/software/S1111) is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.(Citation: Ensilo Darkgate 2018) DarkGate use increased significantly starting in 2022 and is under active development by its author, w...

Executive priority

S1111: DarkGate is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.

Technical view

Security teams should validate S1111: DarkGate by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.

Likely telemetry

Official ATT&CK relationships and object metadata
Network, endpoint, and security-tool telemetry

Detection direction

Validate whether S1111: DarkGate appears in your detection coverage and tabletop scenarios.
Use the object to align executive risk language with SOC, incident response, and detection engineering work.
Do not treat ATT&CK relationship context as attribution without corroborating evidence.

Mitigation priorities

Map the object to existing controls and identify missing telemetry or response ownership.
Prioritize mitigations that reduce exposure on the listed platforms and tactics.
Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.

Additional notes and limits

Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.

This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

DarkGate

DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques58 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1082	System Information Discovery	DarkGate will gather various system information such as domain, display adapter description, operating system type and version, processor type, and RAM amount.[1]CitationRapid7 BlackBasta 2024
Enterprise	T1569.002	Service ExecutionSub-technique	DarkGate tries to elevate privileges to `SYSTEM` using PsExec to locally execute as a service, such as `cmd /c c:\temp\PsExec.exe -accepteula -j -d -s [Target Binary]`.[2]
Enterprise	T1071.004	DNSSub-technique	DarkGate can cloak command and control traffic in DNS records from legitimate services to avoid reputation-based detection techniques. [1]
Enterprise	T1119	Automated Collection	DarkGate searches for stored credentials associated with cryptocurrency wallets and notifies the command and control server when identified.[1]
Enterprise	T1574	Hijack Execution Flow	DarkGate edits the Registry key `HKCU\Software\Classes\mscfile\shell\open\command` to execute a malicious AutoIt script.[1] When eventvwr.exe is executed, this will call the Microsoft Management Console (mmc.exe), which in turn references the modified Registry key.
Enterprise	T1480	Execution Guardrails	DarkGate uses per-victim links for hosting malicious archives, such as ZIP files, in services such as SharePoint to prevent other entities from retrieving them.[2]
Enterprise	T1548.002	Bypass User Account ControlSub-technique	DarkGate uses two distinct User Account Control (UAC) bypass techniques to escalate privileges.[1]
Enterprise	T1622	Debugger Evasion	DarkGate checks the `BeingDebugged` flag in the PEB structure during execution to identify if the malware is being debugged.[2]
Enterprise	T1685	Disable or Modify Tools	DarkGate will terminate processes associated with several security software products if identified during execution.[1]
Enterprise	T1486	Data Encrypted for Impact	DarkGate can deploy follow-on ransomware payloads.[1]
Enterprise	T1566.002	Spearphishing LinkSub-technique	DarkGate is distributed in phishing emails containing links to distribute malicious VBS or MSI files.[2] DarkGate uses applications such as Microsoft Teams for distributing links to payloads.[2]
Enterprise	T1614	System Location Discovery	DarkGate queries system locale information during execution.[1] Later versions of DarkGate query `GetSystemDefaultLCID` for locale information to determine if the malware is executing in Russian-speaking countries.[2]
Enterprise	T1680	Local Storage Discovery	DarkGate uses the Delphi methods `Sysutils::DiskSize` and `GlobalMemoryStatusEx` to collect disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment.[1]
Enterprise	T1010	Application Window Discovery	DarkGate will search for cryptocurrency wallets by examining application window names for specific strings.[1] DarkGate extracts information collected via NirSoft tools from the hosting process's memory by first identifying the window through the `FindWindow` API function.[1]
Enterprise	T1070.004	File DeletionSub-technique	DarkGate has deleted its staging directories.CitationRapid7 BlackBasta 2024
Enterprise	T1036.007	Double File ExtensionSub-technique	DarkGate masquerades malicious LNK files as PDF objects using the double extension `.pdf.lnk`.[2]
Enterprise	T1547.001	Registry Run Keys / Startup FolderSub-technique	DarkGate installation includes AutoIt script execution creating a shortcut to itself as an LNK object, such as bill.lnk, in the victim startup folder.[1]CitationRapid7 BlackBasta 2024 DarkGate installation finishes with the creation of a registry Run key.[1]
Enterprise	T1041	Exfiltration Over C2 Channel	DarkGate uses existing command and control channels to retrieve captured cryptocurrency wallet credentials.[1]
Enterprise	T1027.013	Encrypted/Encoded FileSub-technique	DarkGate drops an encrypted PE file, pe.bin, and decrypts it during installation.[1] DarkGate also uses custom base64 encoding schemas in later variations to obfuscate payloads.[2]
Enterprise	T1552	Unsecured Credentials	DarkGate uses NirSoft tools to steal user credentials from the infected machine.[1] NirSoft tools are executed via process hollowing in a newly-created instance of vbc.exe or regasm.exe.
Enterprise	T1005	Data from Local System	DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.CitationRapid7 BlackBasta 2024
Enterprise	T1047	Windows Management Instrumentation	DarkGate has used WMI to execute files over the network and to obtain information about the domain.CitationRapid7 BlackBasta 2024
Enterprise	T1027	Obfuscated Files or Information	DarkGate uses a hard-coded string as a seed, along with the victim machine hardware identifier and input text, to generate a unique string used as an internal mutex value to evade static detection based on mutexes.[2]
Enterprise	T1490	Inhibit System Recovery	DarkGate can delete system restore points through the command `cmd.exe /c vssadmin delete shadows /for=c: /all /quiet”`.[1]
Enterprise	T1036.003	Rename Legitimate UtilitiesSub-technique	DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the `C:\\` root directory that copies and renames the legitimate Windows curl command to this new location.[2]
Enterprise	T1059.001	PowerShellSub-technique	DarkGate has used PowerShell to create a remote shell.CitationRapid7 BlackBasta 2024
Enterprise	T1496.001	Compute HijackingSub-technique	DarkGate can deploy follow-on cryptocurrency mining payloads.[1]
Enterprise	T1136.001	Local AccountSub-technique	DarkGate creates a local user account, `SafeMode`, via `net user` commands.[1]
Enterprise	T1056.001	KeyloggingSub-technique	DarkGate will spawn a thread on execution to capture all keyboard events and write them to a predefined log file.[1]CitationRapid7 BlackBasta 2024
Enterprise	T1059.010	AutoHotKey & AutoITSub-technique	DarkGate uses AutoIt scripts dropped to a hidden directory during initial installation phases, such as `test.au3`.[1]
Enterprise	T1665	Hide Infrastructure	DarkGate command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.[2]
Enterprise	T1105	Ingress Tool Transfer	DarkGate retrieves cryptocurrency mining payloads and commands in encrypted traffic from its command and control server.[1] DarkGate uses Windows Batch scripts executing the `curl` command to retrieve follow-on payloads.[2] DarkGate has stolen `sitemanager.xml` and `recentservers.xml` from `%APPDATA%\FileZilla\` if present.CitationRapid7 BlackBasta 2024
Enterprise	T1057	Process Discovery	DarkGate performs various checks for running processes, including security software by looking for hard-coded process name values.[1]CitationRapid7 BlackBasta 2024
Enterprise	T1583.001	DomainsSub-technique	DarkGate command and control includes hard-coded domains in the malware chosen to masquerade as legitimate services such as Akamai CDN or Amazon Web Services.[2]
Enterprise	T1555	Credentials from Password Stores	DarkGate use Nirsoft Network Password Recovery or NetPass tools to steal stored RDP credentials in some malware versions.[2]
Enterprise	T1083	File and Directory Discovery	Some versions of DarkGate search for the hard-coded folder `C:\Program Files\e Carte Bleue`.[1]
Enterprise	T1106	Native API	DarkGate uses the native Windows API `CallWindowProc()` to decode and launch encoded shellcode payloads during execution.[2] DarkGate can call kernel mode functions directly to hide the use of process hollowing methods during execution.[1] DarkGate has also used the `CreateToolhelp32Snapshot`, `GetFileAttributesA` and `CreateProcessA` functions to obtain a list of running processes, to check for security products and to execute its malware.CitationRapid7 BlackBasta 2024
Enterprise	T1140	Deobfuscate/Decode Files or Information	DarkGate installation includes binary code stored in a file located in a hidden directory, such as `shell.txt`, that is decrypted then executed.[1] DarkGate uses hexadecimal-encoded shellcode payloads during installation that are called via Windows API `CallWindowProc()` to decode and then execute.[2]
Enterprise	T1204.002	Malicious FileSub-technique	DarkGate initial infection payloads can masquerade as pirated media content requiring user interaction for code execution.[1] DarkGate is distributed through phishing links to VBS or MSI objects requiring user interaction for execution.[2]
Enterprise	T1124	System Time Discovery	DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename.[1] DarkGate queries victim system epoch time during execution.[1] DarkGate captures system time information as part of automated profiling on initial installation.[2]
Enterprise	T1518.001	Security Software DiscoverySub-technique	DarkGate looks for various security products by process name using hard-coded values in the malware.CitationRapid7 BlackBasta 2024 DarkGate will not execute its keylogging thread if a process name associated with Trend Micro anti-virus is identified, or if runtime checks identify the presence of Kaspersky anti-virus. DarkGate will initiate a new thread if certain security products are identified on the victim, and recreate any malicious files associated with it if it determines they were removed by security software in a new system location.[1]
Enterprise	T1566.001	Spearphishing AttachmentSub-technique	DarkGate can be distributed through emails with malicious attachments from a spoofed email address.[1]
Enterprise	T1657	Financial Theft	DarkGate can deploy payloads capable of capturing credentials related to cryptocurrency wallets.[1]
Enterprise	T1115	Clipboard Data	DarkGate starts a thread on execution that captures clipboard data and logs it to a predefined log file.[1]CitationRapid7 BlackBasta 2024
Enterprise	T1574.001	DLLSub-technique	DarkGate includes one infection vector that leverages a malicious "KeyScramblerE.DLL" library that will load during the execution of the legitimate KeyScrambler application.[2]
Enterprise	T1134.004	Parent PID SpoofingSub-technique	DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.[2]
Enterprise	T1574.007	Path Interception by PATH Environment VariableSub-technique	DarkGate overrides the `%windir%` environment variable by setting a Registry key, `HKEY_CURRENT_User\Environment\windir`, to an alternate command to execute a malicious AutoIt script. This allows DarkGate to run every time the scheduled task `DiskCleanup` is executed as this uses the path value `%windir%\system32\cleanmgr.exe` for execution.[1]
Enterprise	T1539	Steal Web Session Cookie	DarkGate attempts to steal Opera cookies, if present, after terminating the related process.CitationRapid7 BlackBasta 2024
Enterprise	T1098.007	Additional Local or Domain GroupsSub-technique	DarkGate elevates accounts created through the malware to the local administration group during execution.[1]
Enterprise	T1059.005	Visual BasicSub-technique	DarkGate initial infection mechanisms include masquerading as pirated media that launches malicious VBScript on the victim.[1]
Enterprise	T1564.001	Hidden Files and DirectoriesSub-technique	DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name.[1] Additionally, DarkGate uses attrib to hide a directory in the following command: ` C:\Windows\system32\attrib.exe” +h C:/rjtu/`.Citationgbhackers Darkgate Malware 2024
Enterprise	T1529	System Shutdown/Reboot	DarkGate has used the `shutdown`command to shut down and/or restart the victim system.CitationRapid7 BlackBasta 2024
Enterprise	T1001	Data Obfuscation	DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.[1]
Enterprise	T1497.001	System ChecksSub-technique	DarkGate queries system resources on an infected machine to identify if it is executing in a sandbox or virtualized environment.[1]
Enterprise	T1561.001	Disk Content WipeSub-technique	DarkGate has deleted all files in the Mozilla directory using the following command: `/c del /q /f /s C:\Users\User\AppData\Roaming\Mozilla\firefox*`.CitationRapid7 BlackBasta 2024
Enterprise	T1036	Masquerading	DarkGate can masquerade as pirated media content for initial delivery to victims.[1]
Enterprise	T1055.012	Process HollowingSub-technique	DarkGate leverages process hollowing techniques to evade detection, such as decrypting the content of an encrypted PE file and injecting it into the process vbc.exe.[1]CitationRapid7 BlackBasta 2024
Enterprise	T1059.003	Windows Command ShellSub-technique	DarkGate uses a malicious Windows Batch script to run the Windows `code` utility to retrieve follow-on script payloads.[2] DarkGate has also used `cmd.exe` to create a remote shell.CitationRapid7 BlackBasta 2024

Associated objects

Groups, software, and campaigns

C0037: Water Curupira Pikabot Distribution

Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.[1]

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 20.0
Object version: 1.1
Created: Feb 9, 2024, 19:52 UTC (UTC+00:00)
Modified: May 12, 2026, 15:12 UTC (UTC+00:00)
Raw hash: a29cd382d9c4a810...

Imported snapshots across ATT&CK releases(3)

Release	Bundle imported	Object version	Modified	Status	Raw hash
20.0	Oct 18, 2026, 20:39 UTC (UTC+00:00)	1.1	May 12, 2026, 15:12 UTC (UTC+00:00)	Current bundle	`a29cd382d9c4…`
19.2	Aug 6, 2026, 02:58 UTC (UTC+00:00)	1.1	May 12, 2026, 15:12 UTC (UTC+00:00)	Older bundle	`a29cd382d9c4…`
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	1.1	May 12, 2026, 15:12 UTC (UTC+00:00)	Older bundle	`a29cd382d9c4…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Ensilo Darkgate 2018
Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.
Open source URL
[2]
Trellix Darkgate 2023
Ernesto Fernández Provecho, Pham Duy Phuc, Ciana Driscoll & Vinoo Thomas. (2023, November 21). The Continued Evolution of the DarkGate Malware-as-a-Service. Retrieved February 9, 2024.
Open source URL
[3]
mitre-attackS1111
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use