DarkGate Malware Targets Excel Files & SMB Shares

DarkGate (Mar–Apr 2024) is a widespread malware campaign that leveraged exposed Samba/SMB file shares and malicious Excel documents to download VBS/JS and PowerShell stagers that deploy an AutoHotKey-based loader. The malware uses anti-analysis checks (VM/CPU checks, AV scanning), obfuscated shellcode, XOR-based configuration variations, unencrypted Base64 HTTP C2 channels, and large data exfiltration via HTTP POST; it operates as a MaaS and has targeted victims across North America, Europe, and Asia.