DarkGate Loader: Forensic Reverse-Engineering & Architectural Dossier

Constructed primarily in Embarcadero Delphi, resulting in substantial PE files characterized by Borland Delphi runtime signatures, Visual Component Library (VCL) metadata, and extensive RTTI tables. Delivery relies on multi-stage modular execution pipelines: typically an initial Windows Installer (.msi) package, VBScript, or PDF lure extracts a legitimate compiled AutoIt3.exe executable alongside an heavily obfuscated AutoIt script (.au3 or .a3x). The script performs in-memory shellcode reconstruction and injects the core Delphi PE into user-mode processes.

DarkGate is managed through a closed-access web management dashboard rented as Malware-as-a-Service (MaaS). Configuration settings are embedded in the compiled Delphi binary within an obfuscated string block. The configuration parser decrypts this block using a unique 64-character custom Base64 alphabet (substituting the standard RFC 4648 character set with a pseudo-random permutation, e.g., 'zLAxuU0kMmrs...') followed by a multi-byte XOR key. Decrypted configuration flags: Index 0: C2 Server URL list; Index 1: Ping/Heartbeat interval (seconds); Index 2: Anti-Analysis and Anti-VM toggle; Index 3: Embedded Cryptominer flag; Index 4: Registry Run Key persistence string; Index 5: XOR Encryption Key for C2 communications; Index 6: Campaign Identifier; Index 7: Botnet Group Tag.

struct DarkGate_Loader_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

The AutoIt staging script allocates heap memory via kernel32.dll!VirtualAlloc(PAGE_EXECUTE_READWRITE) and invokes shellcode using CallWindowProc or DllCallAddress. The shellcode serves as a custom reflective loader: it parses its own embedded DarkGate Delphi payload, allocates virtual memory, manually resolves imports via API hashing (hashing Win32 API names with a modified ROR-13 algorithm), and applies base relocations. DarkGate incorporates NTAPI direct syscall stagers to bypass user-mode API hooking installed by EDR products on ntdll.dll (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtProtectVirtualMemory). It performs aggressive anti-VM verification: queries CPUID hypervisor bit, inspects disk drive strings for 'VMware', 'VBOX', 'QEMU', measures Sleep execution timing against GetTickCount64, and enumerates installed software checking for analysis tools (Wireshark, Process Hacker, x64dbg).

Concrete technical breakdown of functional modules implemented in the DarkGate Loader binary:

Communication utilizes HTTP/HTTPS POST requests over custom TCP ports (e.g., 80, 443, 2355, 9999). Message bodies are encrypted using the custom Base64 alphabet and XOR key extracted from the configuration. Request structure: HTTP POST /<random_string> HTTP/1.1; Host: <C2_IP>; User-Agent: <Custom_or_Mozilla>; Content-Type: application/x-www-form-urlencoded. Request body payload contains key-value pairs formatted as: 'id=<Victim_ID>&data=<Encrypted_Blob>'. The C2 server returns an encrypted task string parsed by the client dispatch loop into numerical task codes: Code 1: Download and execute secondary binary; Code 2: Execute shell command via cmd.exe; Code 3: Activate HVNC module; Code 4: Start/Stop Cryptominer; Code 5: Terminate and self-delete.

Indicators of compromise and forensic patterns recorded across laboratory triage: