DarkAngle

Posted: October 5, 2012

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	10/10
Infected PCs:	30

First Seen:	October 5, 2012
Last Seen:	March 1, 2023
OS(es) Affected:	Windows

DarkAngle is a Trojan that steals confidential information from your PC. Installation for DarkAngle relies on social engineering techniques – with DarkAngle's icon and file information set to make DarkAngle look like a popular anti-virus program, victims may install DarkAngle thinking they're getting additional anti-malware protection. Due to the deceptive nature of DarkAngle's packaging, SpywareRemove.com malware researchers recommend scanning any installers for anti-virus programs prior to launching them, particularly in cases of files that are downloaded from potentially compromised sources (such as torrent networks or general freeware sites). If you do install DarkAngle by mistake, you should use competent anti-malware software to delete DarkAngle as soon as you can, since DarkAngle has been associated with high-level privacy breaches that can include compromised bank account information.

The Light Side of DarkAngle is All on the Outside

Current installers for DarkAngle Trojans use various details to make themselves look like installers for the Panda Cloud Antivirus program. These details include the brand's icon and company, with the file name using simple numbers that are reminiscent of version numbers. Notably, file names for DarkAngle installers have kept rough pace with the various updates to Panda Cloud Antivirus – one sample of a DarkAngle file that SpywareRemove.com malware experts have found uses the file name '2.4', whereas the actual AV program was updated to version 2.0 back in July of this year. Due to its specific disguise, DarkAngle installers may be distributed by malicious sites that present DarkAngle as an AV program or through downloading networks that include false AV-themed labels for DarkAngle. In light of this threat, if you do need to download anti-virus software, it's recommended that you stick to trustworthy sources.

DarkAngle has been connected to a range of different attacks. Common issues that SpywareRemove.com malware research team has found to be related to DarkAngle and similar PC threats include:

Keylogging attacks that record your keyboard input (typing) for the sake of stealing passwords and other personal information.
Screen captures that steal information through visual means.
Form grabs that monitor and record input to HTML forms – this includes password fields, checkboxes, some types of buttons and other 'control' elements that are often used on websites.
Code injection attacks that insert malicious content into some normal web pages. Trojans like DarkAngle that target bank account data may insert additional phishing attacks into bank web pages that request you to enter extra information (your Social Security Number, credit card credentials, etc).

Waving DarkAngle's Shroud of Deception Off

DarkAngle launches with Windows and conceals itself from both casual observance and anti-malware programs. However, adequately advanced anti-malware products should be able to detect DarkAngle, particularly if extra security techniques – such as Safe Mode or booting from a removable hard drive – are employed. SpywareRemove.com malware researchers discourage efforts to find or remove DarkAngle without help from appropriate security software if any other options are available, since attempts to delete DarkAngle casually can result in harm to operating system files like the Registry.

Any passwords and other stolen information will remain in criminal hands even after you've deleted DarkAngle. If you have any cause to think that DarkAngle transmitted stolen information prior to its removal, SpywareRemove.com malware experts recommend that you contact your bank, if applicable, and change all at-risk passwords.

Technical Details

Registry Modifications

The following newly produced Registry Values are:

Regexp file mask%temp%\scam.jpg