DarkComet Sample: EF3E41EC91F8BE14

DarkComet Malware Analizi

Dosya Ozellikleri

SHA256: ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017

MD5: c24b05b25c28e5e7a1231a62be80bc12

Dosya Tipi: exe

Boyut: 16,358,830 byte

Ilk Gorulme: 2026-04-26

AV Imzasi: DarkComet

Imphash: dcaf48c1f10b0efa0a4472200f3850ed

Raporlayan: CNGaoLing

Etiketler: DarkComet, exe, xred, XRedRAT

Statik analiz: metadata tabanli (ornek indirilmedi)

DarkComet — Malware Profile

DarkComet RAT Delphi tabanlı. Facebook.exe sosyal medya gizleme. IAMStreamConfig4 DirectShow webcam/mikrofon. MSConfig startup kalıcılık.

Malware Type

RAT

Programming Language

Delphi

C2 Protocol

TCP

Target Systems

Windows

Technical Details

Delphi, TCP custom protocol, keylogger (KEYLOGGER_PASSIVE/ACTIVE), screen capture, webcam/microphone, file manager, registry editor, remote shell, FTP-like file transfer

Capabilities & Behavior

Uzaktan Erişim & Kontrol

Keylogger

Ekran Görüntüsü

Webcam Erişimi

Dosya Yönetimi

Süreç Yönetimi

Komut Yürütme

Kalıcılık Mekanizması

IOC List (1 indicators)

IOC — DarkComet Copy

# FILEPATH ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017

Type	Value	Note
filepath	ef3e41ec91f8be146c3588321f98be8d3db3933d3881112554898e7eefb8b017	PDB

C2 Servers (1 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
dkcomet.dedyn.io	domain	1604	TCP	inactive	DE

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.