DarkComet Malware Analysis

File Properties

SHA256: 649690e091197a93c4fec4656691711d4e73a8da68aa026898622932c3a533c1

MD5: a2e50a93a9ec5fe9b5e766fc4f583705

File Type: exe

Size: 244,736 byte

First Seen: 2022-08-31

AV Signature: DarkComet

Imphash: efe1ad7933b20173c7fdf4914181c429

Reported By: abuse_ch

Tags: DarkComet, exe, RAT

Static analysis: metadata-based (sample not downloaded)

DarkComet — Malware Profile

DarkComet RAT Delphi tabanlı. Facebook.exe sosyal medya gizleme. IAMStreamConfig4 DirectShow webcam/mikrofon. MSConfig startup kalıcılık.

Malware Type
RAT
Programming Language
Delphi
C2 Protocol
TCP
Target Systems
Windows

Technical Details

Delphi, TCP custom protocol, keylogger (KEYLOGGER_PASSIVE/ACTIVE), screen capture, webcam/microphone, file manager, registry editor, remote shell, FTP-like file transfer

Capabilities & Behavior

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC List (1 indicators)

IOC — DarkComet
# FILEPATH 649690e091197a93c4fec4656691711d4e73a8da68aa026898622932c3a533c1
TypeValueNote
filepath 649690e091197a93c4fec4656691711d4e73a8da68aa026898622932c3a533c1 PDB
DarkComet — Go to Full Profile →

C2 Servers (1 recorded servers for this family)

Address Type Port Protocol Status Country
dkcomet.dedyn.io domain 1604 TCP inactive DE

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
DarkCometexeRAT