Palo Alto Networks Unit 42’s Post

View organization page for Palo Alto Networks Unit 42
Palo Alto Networks Unit 42

87,685 followers

2024-05-14 (Tuesday): #DarkGate activity. HTML file asks victim to paste script into a run window. Indicators available at https://bit.ly/4bjvMAC #TimelyThreatIntel #Unit42ThreatIntel #Wireshark #InfectionTraffic

  • unknown source --> HTML file --> victim runs CMD script from HMTL file --> downloads & runs HTA file --> retrieves & runs PowerShell script --> Retrieves & runs Autoitv3 package for DarkGate --> DarkGate C2
  • Browser window. HTML file. Victim pastes script into run window and runs it. Arrows point to each step in the process.
  • Screenshots of Startup folder, Properties folder, ProgramData folder. DarkGate persistent on the infected host. Arrows point to each step.
  • Infection traffic filtered in Wireshark. From top to bottom: Returned HTA file. Returned PowerShell script. Returned ZIP archive of AutoIt3 package for DarkGate. DarkGate C2 traffic.
Mikako Yano

--

1y

Interesting!

Like
Reply
Steve Eyre

Enterprise Security Architect | Cyber Operations & Threat Intelligence consultant | SOC architect | Cyber3D fractional security owner

1y

the old HTA trick, old school but surprisingly prevalent

Like
Reply
2 Reactions
See more comments

To view or add a comment, sign in

More Relevant Posts

Palo Alto Networks Unit 42

87,685 followers

View Profile

Explore topics