Featured Image

DarkComet RAT 1.3

Family Name DarkComet RAT
Main Classification Remote Access
Release Version 1.3
Author DarkCoderSc
Origin France 🇫🇷
Affiliation OpenSc.Ws
Languages Delphi , Assembly
Default Port 1604
Release Date Nov, 2009, 16 years, 9 months ago.

Historical Events / Facts

2017
DarkComet and the Umbrage Project

Leaked CIA documents published by WikiLeaks revealed that the agency's secretive "Umbrage" team actively collected and studied widespread malware, including the DarkComet RAT.

2015
Kevin Mitnick's DarkComet Live Demonstrations

Renowned hacker and cybersecurity consultant Kevin Mitnick frequently utilized the DarkComet RAT to conduct live hacking demonstrations during his security conferences, and was even willing to purchase the project's source code for his professional needs. One of his most notable public showcases took place at the CeBIT 2015 technology trade fair, where he used the tool to actively demonstrate real-world cyber threats to the audience.

2012
The RAT Weaponized Against Syrian Activists

Syrian government weaponized DarkComet to bypass encrypted communications and surveil activists during the civil war. DarkComet was distributed through malicious Skype messages disguised with a fake Facebook icon, secretly installing itself to monitor citizens and reportedly leading to widespread arrests. Upon discovering his tool was being exploited by the Assad regime for state-sponsored espionage, DarkComet's creator immediately and permanently halted the project's development.

Screenshots

Distributed Applications / Files

upx.exe

upx.exe

yC.exe

yC.exe

client.exe

client.exe

Key Features

Feature Name Dangerousness Key Categories
Clipboard Manager logoClipboard Manager High Credentials, Exfiltration
Destructive Operations logoDestructive Operations High Disruption, Alteration
File Manager logoFile Manager High File System, Disruption, Exfiltration, Alteration
Keylogger logoKeylogger High Credentials, Spy / Surveillance
Network Manager logoNetwork Manager High Disruption, Credentials, Eavesdropping, Exfiltration, Lateral Movements
Password Recovery logoPassword Recovery High Credentials, Privilege Escalation, Lateral Movements
Registry Manager logoRegistry Manager High Disruption, Credentials, Exfiltration, System Management, Alteration
Remote Desktop / Screen Capture logoRemote Desktop / Screen Capture High Spy / Surveillance, Assistance
Shell Access logoShell Access High Privilege Escalation, Lateral Movements, System Management
System Information Gathering logoSystem Information Gathering High Privilege Escalation, Lateral Movements, Spy / Surveillance
Webcam Capture logoWebcam Capture High Spy / Surveillance
Process Manager logoProcess Manager Medium Disruption, System Management
Services Manager logoServices Manager Medium Privilege Escalation, Disruption, Assistance
Application / Window Manager logoApplication / Window Manager Low Disruption, Spy / Surveillance
Fun / Troll Functions logoFun / Troll Functions Low Disruption, Alteration

Malware Family References

Other Releases

Version Origins Authors Languages Release Date
DarkComet RAT 2.0 RC4 logoDarkComet RAT 2.0 RC4 France 🇫🇷 DarkCoderSc Delphi Mar, 2010
DarkComet RAT 2.0 RC7 logoDarkComet RAT 2.0 RC7 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2010
DarkComet RAT 3.0 logoDarkComet RAT 3.0 France 🇫🇷 DarkCoderSc Assembly, Delphi Nov, 2010
DarkComet RAT 5.3 logoDarkComet RAT 5.3 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2012
DarkComet RAT 5.3.1 logoDarkComet RAT 5.3.1 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2012
Previous Release Next Release
});