BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
31
Global rank
48 infographic chevron month
Month rank
46 infographic chevron week
Week rank
0
IOCs

DarkComet RAT is a malicious program designed to remotely control or administer a victim's computer, steal private data and spy on the victim.

RAT
Type
France
Origin
12 February, 2008
First seen
14 September, 2024
Last seen
Also known as
Breut
Fynloski
klovbot

How to analyze DarkComet RAT with ANY.RUN

RAT
Type
France
Origin
12 February, 2008
First seen
14 September, 2024
Last seen

IOCs

IP addresses
193.161.193.99
45.74.4.244
78.163.16.186
193.149.180.137
176.108.108.71
75.4.61.28
223.244.83.13
140.82.13.202
46.2.15.197
151.236.21.83
185.60.133.214
80.85.154.180
80.85.156.184
40.76.20.9
88.169.146.156
79.143.38.55
78.190.191.194
45.32.255.220
109.61.248.34
37.1.217.131
Hashes
e8e7f7884a71d42ed63bc2b9b18ccfd8a1d654f65ab9ec168634250e484403f0
3289160b2febeb4b0c2688648faf5eb9f8bded8f1e36934d8a280c44d314470b
d97c021e728bb9f7a1c242240427af52762742e672ac7beec2c7803d1b15eb2b
5b7b85aa622b2a4cfab365f37a361f480226304f50d13df4f5ded14ff81e7c8f
a0e20ae84b5f842db75c23fb673d6868757befbad33ba25f9a66c90766e76583
3a10b522bd5671caa045d7e509acf0510ed736d792b4b7344b3f66b2e432eeab
2fe39c852239162864a9c75f46d46801da1fbe4801d0d4a61545066d9b72aa6e
42cadb98f1c11097d4225b2362e6401fe0f824a252f678cc56f7f8ccc3aa864a
042cabcd28c5df1105cbc70433dc224099d5448652aa9c083801cbaf2d920f71
6d4ad41c2dc18f519f90d55afef66846812c190d27c8dd8c27b3b3417fda08d0
148d0e58dcea68e885db2209ec43a027ee12463c17ec996c9d82e52ef376f077
3d6831d8d2df91ae9dd48dfea289c59feda761e5c079cb6a74f6ff5815d0dc29
ce6ac667fd1d55b58788afddb0dd811d5da2a01e5b4b70d2bda2d18aabb421e2
ff1b307e97642afd09aafcc78c44d4606080c9ac545b62936c18bde85733c9fd
16179c1f1a747f42cf2c633a1b67baa815ed74f0f217cf3d599abc04e877a3b5
cb6a4df378008215322360aa60bcc611396cd9f01a1a4e7e614530d1d71d3f48
25ee55fef74068241cdba1de35397d4ed96c53beb1445d0ba823cc1ee7ca77b6
55c6dea9b181117f6a5f81abd4d8fb2466704bb4a668c325967a6ce06ba762d0
e6a41dadfaff162c974bb2ed42a94b65383b36d2a87fb0fafe4149bf75ab5f73
7af56463c5a109324946870e78fafa5359b88df375534c84b6cbcedbcba849a6
Domains
0.tcp.eu.ngrok.io
4.tcp.eu.ngrok.io
4.tcp.ngrok.io
7.tcp.eu.ngrok.io
5.tcp.eu.ngrok.io
eu-central-7075.packetriot.net
2.tcp.eu.ngrok.io
6.tcp.ngrok.io
positive-be.at.playit.gg
papka142.ddns.net
dgorijan20785.hopto.org
6.tcp.eu.ngrok.io
myhackth.myftp.org
212.ip.ply.gg
b7r.duckdns.org
whatis79.ddns.net
chrisle79.ddns.net
goodgt79.ddns.net
smath79.ddns.net
jacknop79.ddns.net
URLs
tcp://6.tcp.eu.ngrok.io:11380/
http://glaucogeraint.pagekite.me/
http://glaucogeraint.pagekite.me/favicon.ico
Last Seen at

Recent blog posts

post image
ANY.RUN Now Integrates with Splunk!
watchers 316
comments 0
post image
How to Analyze Malware in ANY.RUN Sandbox: Er...
watchers 365
comments 0
post image
Security Training Lab: Educational Program fo...
watchers 1162
comments 0

What is DarkComet RAT?

DarkComet is a remote access trojan developed by Jean-Pierre Lesueur in 2008. According to him, the program was never intended to be used illegally. But it got viral in 2012 after the Syrian incident: the government used the RAT to spy and destroy the protestor’s network.

It’s a standard remote control malware – a hacker rules over the infected computer and gets access to the camera and microphone. That is why DarkComet serves as a tool to monitor victims’ actions, take screenshots, do key-logging, or steal credentials.

The malware has had several versions, and DarkComet 5.3.1 is still available in 2022.

Crooks try to make targets download and run the RAT using different social engineering techniques. And in some cases, attackers use DarkComet to deliver other malicious programs to the infected machine. Hackers may involve the victim machine in a botnet scheme, such as sending spam.

DarkComet malware analysis

ANY.RUN allows researchers to analyze DarkComet samples and monitor the malware’s activity in real-time using an interactive sandbox

darkcomet rat process graph

Figure 1: Process graph of DarkComet execution generated by ANY.RUN

DarkComet Execution process

DarkComet has a typical RAT execution.

The infected system connects to the hacker’s computer and gives the attacker full access. Crooks may exploit all the system's features: the infected machine is ready to get packets and perform the commands.

Systems communicate via TCP to the chosen DarkComet malware port on the selected IP/domain. Then C&C traffic begins with RC4-256 encryption.

The execution process of the DarkComet varies depending on the sample and version. The most straightforward execution is just one process that makes all activities in the infected system.

In some cases, malware may use system utilities to defend against evasion or persistence. For example, in this task, it uses the T1564.001 technique: malware starts attrib.exe through cmd.exe to hide the main executable. In the system process, iexplorer was injected with malicious code and provided the main malicious activity afterward.

Distribution of DarkComet malware

To trick people into downloading and installing programs such as Quasar RAT, njRAT, and DarkComet cybercriminals use:

  • other trojans
  • suspicious file or software download channels
  • fake software updates and/or unofficial activation tools
  • phishing

Emails may include malicious content in various formats like Microsoft Office documents, PDF documents, .exe files, ZIP and RAR archives, JavaScript files, etc.

After a user is tricked into downloading and then opening a file, it installs other malware.

How to detect DarkComet using ANY.RUN?

darkcomet rat memory dump

Figure 2: DarkComet memory dump

ANY.RUN automatically creates a memory dump of the running process and matches it with the Yara rule. After DarkComet detection, its config is available to researchers for subsequent analysis in no time.

In our example, malware configuration was extracted just 10 seconds after the task launch.

Conclusion

Having DarkComet downloaded on your working station can cause severe issues. And it’s better to get rid of it immediately. Concerning the SOC’s specialists' goal, the analysis of the RAT’s infection should be carried out as soon as possible. And with ANY.RUN sandbox it’s easy to do.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More