All You Need To Know About DarkGate Internals

**Executive Summary:** This technical report analyzes DarkGate, a modular loader/RAT offered as Malware-as-a-Service that provides reverse shells, hVNC, keylogging, Discord token theft, PowerShell execution, privilege escalation, and multiple evasion techniques (custom base64 alphabets, Union API/syscall usage, dynamic API resolution, LOLBAS DLL loading, APC injection), details its C2 communication and artifacts for hunting, and notes active use by multiple threat actors.