Loading malware…
DarkComet is a Delphi-based remote access trojan for Microsoft Windows, created in 2008 by a French developer. Its developer discontinued development in 2012 following reports of its use against Syrian activists, but existing versions continued to circulate. The malware provides concealed, interactive control of compromised systems through remote screen viewing, mouse and keyboard control, and script execution. Its information-gathering capabilities include keylogging, credential theft, retrieval of victim files, process enumeration, and collection of the current username.
DarkComet establishes persistence through Windows Registry autostart entries and has also been deployed through Startup-folder mechanisms. It uses process hollowing to execute malicious code within another process and has masqueraded as legitimate Windows or security software to reduce suspicion. DarkComet payloads have also been deployed using fileless VBScript injectors leveraging DynamicWrapperX. Operators have used ngrok TCP tunnels to conceal the location of command-and-control servers.
DarkComet has been used in espionage operations, including attacks against Syrian activists, and is associated with the toolsets of APT33, APT38, and ALUMINUM SARATOGA. These associations reflect use by multiple threat actors rather than exclusive ownership by a single group.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
Observed lure documents repeatedly made use of CVE-2012-0158, CVE-2014-1761, CVE-2013-3906, CVE-2015-1641 exploits to drop and execute their malware of choice. | The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
"...spear-phishing emails with malicious RTF files exploiting CVE-2010-3333 or CVE-2012-0158..." | "...off-the-shelf remote administration tools (RATs) and downloaders, such as DarkComet and Bozok."
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.
ALUMINUM SARATOGA ... Tools ... BlackShades, BrittleBush, DarkComet, LastConn, Micropsia, NimbleMamba, PoisonIvy, QuasarRAT, XtremeRat
The threat actor uses spearphishing with malicious documents to deliver malware, such as NetWire, DarkComet, and simple keyloggers... The primary malware families deployed were NetWire and DarkComet remote access trojans (RATs).
The top 10 of the RATs used in Nigerian BEC scams is formed by NetWire, DarkComet, NanoCore, LuminosityLink, Remcos, ImminentMonitor, NJRat, Quasar, Adwind, and Hworm.
20 distinct techniques documented for this family, organized by ATT&CK tactic.
Useful starting points are MITRE ATT&CK techniques for remote access software (T1219)
166 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
94 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows RAT providing remote desktop, webcam capture, keylogging, file transfer, and a remote shell. Development stopped in 2012 following reports of surveillance against Syrian activists, but leaked builders remain available. Default TCP port 1604 and DC_MUTEX names are useful legacy indicators.
Backdoor/RAT payload dropped via malicious Steam Wallpaper Engine packages to hijack Steam sessions and support account theft and further propagation.
Remote access trojan/backdoor delivered via malicious Steam Workshop Wallpaper Engine application wallpapers; used to establish backdoor access on infected systems.
Backdoor/RAT family deployed via malicious Wallpaper Engine projects; in the described sample it was installed under the name Synaptics.exe as part of the infection chain.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.