Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1076769" data-attributes="member: 32260">WHHLight vs. DarkGateWhen inspecting the samples recently uploaded to the well-known malware repository, I noticed a few signed samples of DarkGate. Generally, between July 2023 and February 2024, most DarkGate samples were unsigned, except for about 10% of samples signed with highly reputable EV certificates. Those samples are interesting because the malware with an EV certificate can bypass SmartScreen. Home users are not the targets of DarkGate, but such an attack vector can show some aspects of WDAC ISG.I am not sure what was the exact infection flow, so I assumed the attack vector which can be a challenge for WHHLight. It is described as follows (last known campaign from October 2023):[URL unfurl=&quot;false&quot;]https://www.netskope.com/blog/new-darkgate-variant-uses-a-new-loading-approach[/URL]Attack flow (slightly shortened):Phishing or SEO poisoning ----&gt;&nbsp; EXE or MSI file with EV certificate&nbsp; ----&gt;&nbsp; legal EXE + malicious DLL dropped/executed (DLL hijacking)&nbsp; ---&gt;&nbsp; legal Autoit.exe + Autoit script executed ----&gt;&nbsp; DarkGate payload[URL unfurl=&quot;false&quot;]https://www.virustotal.com/gui/file/5f3ab1889a15e561d15e919df803f26ed3c7c76850893768e143dff7d5d96e69[/URL][URL unfurl=&quot;false&quot;]https://www.virustotal.com/gui/file/edb20f1e3fb92954b89c8158e58bd012b4d256082ec5b01767474e3731350da5[/URL][URL unfurl=&quot;false&quot;]https://www.virustotal.com/gui/file/3bf99810510c197b9cd6e434d95417515dbc42f94b11bbf9916ec160066eb77e[/URL][URL unfurl=&quot;false&quot;]https://www.virustotal.com/gui/file/693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a[/URL]The EV-signed EXE/MSI samples were executed with MotW and were allowed by SmartScreen (no SmartScreen alert), but blocked by WDAC ISG. Fortunately, ISG (with SmartScreen backend) does not blindly pass by the malware signed with an EV certificate.</blockquote>

[QUOTE="Andy Ful, post: 1076769, member: 32260"] [B][SIZE=5]WHHLight vs. DarkGate[/SIZE][/B] When inspecting the samples recently uploaded to the well-known malware repository, I noticed a few signed samples of DarkGate. Generally, between July 2023 and February 2024, most DarkGate samples were unsigned, except for about 10% of samples signed with highly reputable EV certificates. Those samples are interesting because the[COLOR=rgb(184, 49, 47)][B] malware with an EV certificate can bypass SmartScreen[/B][/COLOR]. Home users are not the targets of DarkGate, but such an attack vector can show some aspects of WDAC ISG. I am not sure what was the exact infection flow, so I assumed the attack vector which can be a challenge for WHHLight. It is described as follows (last known campaign from October 2023): [URL unfurl="false"]https://www.netskope.com/blog/new-darkgate-variant-uses-a-new-loading-approach[/URL] [B][COLOR=rgb(184, 49, 47)]Attack flow (slightly shortened):[/COLOR] Phishing or SEO poisoning ----> EXE or MSI file with EV certificate ----> legal EXE + malicious DLL dropped/executed (DLL hijacking) ---> legal Autoit.exe + Autoit script executed ----> DarkGate payload[/B] [URL unfurl="false"]https://www.virustotal.com/gui/file/5f3ab1889a15e561d15e919df803f26ed3c7c76850893768e143dff7d5d96e69[/URL] [URL unfurl="false"]https://www.virustotal.com/gui/file/edb20f1e3fb92954b89c8158e58bd012b4d256082ec5b01767474e3731350da5[/URL] [URL unfurl="false"]https://www.virustotal.com/gui/file/3bf99810510c197b9cd6e434d95417515dbc42f94b11bbf9916ec160066eb77e[/URL] [URL unfurl="false"]https://www.virustotal.com/gui/file/693ff5db0a085db5094bb96cd4c0ce1d1d3fdc2fbf6b92c32836f3e61a089e7a[/URL] [B][COLOR=rgb(0, 168, 133)]The EV-signed EXE/MSI samples were executed with MotW and were allowed by SmartScreen (no SmartScreen alert), but blocked by WDAC ISG. Fortunately, ISG (with SmartScreen backend) does not blindly pass by the malware signed with an EV certificate.[/COLOR][/B] [/QUOTE]

Verification