Member-only story
It’s Dark(gate)!
We are back today with a new malware file type analysis. Today we’re going to dissect an HTML file that was downloaded from Malware Bazaar, it was tagged as delivering DarkGate malware.
Malware Bazaar
The original filename “sec_may_445515.html”, this was tagged as delivered via Malspam (Malware Spam) email delivered to the recipient.
Link to download the sample, if you want to follow along: MalwareBazaar | SHA256 79e9ac00c9d012518a4b97e6eca876fb1546cd8f3fe23978acdf7f2c612e030d (DarkGate) (abuse.ch)
Peeling the layers!
DarkGate utilizes multiple scripts that download the subsequent stages, ultimately leading to the download of AutoIT3 and an AutoIT3 script.
Let’s open the original HTML file in a text editor to look at the code, the first thing that stands out on opening the file is the big blob of base64 data which appears to be a background image of some kind. On scrolling through the HTML file, we see that there are 3 base64 encoded blobs which appear to be images.
