DarkComet Malware Analizi

Dosya Ozellikleri

SHA256: cdfbf7ad68084061a30921f3df335a0cdab12750c9b38f3187208ee2a8b1c752

MD5: df3bcb2f9042c880dd8c776c190bcd59

Dosya Tipi: exe

Boyut: 657,047 byte

Ilk Gorulme: 2023-04-15

AV Imzasi: DarkComet

Imphash: 2f6203366bc5aa9ff8b6cf7753ead32d

Raporlayan: anonymous

Etiketler: DarkComet, exe, RAT

Statik analiz: metadata tabanli (ornek indirilmedi)

DarkComet — Malware Profile

DarkComet RAT Delphi tabanlı. Facebook.exe sosyal medya gizleme. IAMStreamConfig4 DirectShow webcam/mikrofon. MSConfig startup kalıcılık.

Malware Type
RAT
Programming Language
Delphi
C2 Protocol
TCP
Target Systems
Windows

Technical Details

Delphi, TCP custom protocol, keylogger (KEYLOGGER_PASSIVE/ACTIVE), screen capture, webcam/microphone, file manager, registry editor, remote shell, FTP-like file transfer

Capabilities & Behavior

Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması

IOC List (1 indicators)

IOC — DarkComet
# FILEPATH cdfbf7ad68084061a30921f3df335a0cdab12750c9b38f3187208ee2a8b1c752
TypeValueNote
filepath cdfbf7ad68084061a30921f3df335a0cdab12750c9b38f3187208ee2a8b1c752 PDB
DarkComet — Go to Full Profile →

C2 Servers (1 recorded servers for this family)

Address Type Port Protocol Status Country
dkcomet.dedyn.io domain 1604 TCP inactive DE

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.

Tags
DarkCometexeRAT