Once the DarkGate payload is executed, the malware achieves persistence by dropping a randomly named LNK file to the Windows User Startup folder, enabling automatic execution of the file at every system startup.

Source: https://www.scmagazine.com/news/skype-message-threads-hijacked-to-spread-darkgate-malware