DarkComet RAT
DarkComet RAT is a remote access trojan with extensive espionage and data-theft capabilities. The provided content describes it as enabling covert remote control of infected systems and supporting capabilities including offline keylogging, credential theft, file theft, webcam surveillance, remote desktop control, and process injection into legitimate processes such as notepad.exe. In the analyzed campaign, captured keystrokes were stored locally in a folder named dclogs.
The malware was observed in a campaign using Bitcoin-themed social-engineering lures. A RAR archive posed as a legitimate cryptocurrency application and contained an executable named "94k BTC wallet.exe". When executed, it silently deployed DarkComet RAT. The sample was packed with UPX and, after unpacking, was identified as Backdoor.DarkComet compiled with Borland Delphi (2006).
For persistence, the sample copied itself to %AppData%\Roaming\MSDCSC\explorer.exe and created a Windows Run key for autostart. Reported embedded configuration and indicators included the mutex DC_MUTEX-ARULYYD, install path MSDCSC\explorer.exe, command-and-control domain kvejo991.ddns.net, and TCP port 1604. Behavioral analysis showed repeated beaconing attempts to kvejo991.ddns.net:1604, with retransmissions suggesting the server was offline or blocking connections.
The content also states that DarkComet RAT has extensive espionage capabilities and was used by the Assad regime in Syria against Syrians seeking freedom from oppression. It further notes that DarkComet was discontinued by its original developer years ago, but continues to circulate in underground forums and cybercrime toolkits and is still repurposed in modern campaigns.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A new piece of old computer spyware, known as DarkComet RAT, was found cleverly hidden inside a file that looked exactly like a legitimate Bitcoin wallet or trading program.
A new piece of old computer spyware, known as DarkComet RAT, was found cleverly hidden inside a file that looked exactly like a legitimate Bitcoin wallet or trading program.
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
4 techniques
Stealth
"delivered inside a compressed RAR file, which is a common trick used by attackers to evade security filters"
Credential Access
1 technique
Credential Access
Collection
3 techniques
Collection
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used for surveillance and data theft. In this campaign it is disguised as a Bitcoin wallet utility, packed with UPX, establishes persistence by copying itself to %AppData%\Roaming\MSDCSC\explorer.exe and creating a Run key, performs keylogging (stores logs in 'dclogs'), uses process injection (e.g., into notepad.exe), and beacons to a C2 server over TCP.
Remote access trojan that provides covert remote control of an infected system, including keylogging, file theft, webcam spying, and remote desktop control. In the described campaign it is delivered via a RAR archive containing a fake Bitcoin wallet executable, establishes persistence via an autostart entry, and beacons to a DDNS C2 (kvejo991.ddns.net:1604) while logging keystrokes to a local 'dclogs' folder to steal credentials (including crypto wallet access).
Remote access trojan with extensive espionage capabilities, discussed as surveillance malware used against targets in Syria.
Remote access trojan with extensive espionage capabilities, cited here as an example of surveillance malware being repurposed for malicious political repression.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.