Featured Image

DarkComet RAT 3.0

Family Name DarkComet RAT
Main Classification Remote Access
Release Version 3.0
Author DarkCoderSc
Origin France 🇫🇷
Affiliation OpenSc.Ws
Languages Delphi , Assembly
Default Port 1604
Release Date Nov, 2010, 15 years, 5 months ago.

Historical Events / Facts

2017
DarkComet and the Umbrage Project

Leaked CIA documents published by WikiLeaks revealed that the agency's secretive "Umbrage" team actively collected and studied widespread malware, including the DarkComet RAT.

2015
Kevin Mitnick's DarkComet Live Demonstrations

Renowned hacker and cybersecurity consultant Kevin Mitnick frequently utilized the DarkComet RAT to conduct live hacking demonstrations during his security conferences, and was even willing to purchase the project's source code for his professional needs. One of his most notable public showcases took place at the CeBIT 2015 technology trade fair, where he used the tool to actively demonstrate real-world cyber threats to the audience.

2012
The RAT Weaponized Against Syrian Activists

Syrian government weaponized DarkComet to bypass encrypted communications and surveil activists during the civil war. DarkComet was distributed through malicious Skype messages disguised with a fake Facebook icon, secretly installing itself to monitor citizens and reportedly leading to widespread arrests. Upon discovering his tool was being exploited by the Assad regime for state-sponsored espionage, DarkComet's creator immediately and permanently halted the project's development.

Screenshots

Distributed Applications

dc_msgbox.dll

dc_msgbox.dll

Client.exe

Client.exe

Key Features

Feature Name Dangerousness Key Categories
Clipboard Manager logoClipboard Manager High Exfiltration, Credentials
Denial Of Service / DDoS logoDenial Of Service / DDoS High Alteration, Disruption
Destructive Operations logoDestructive Operations High Alteration, Disruption
File Manager logoFile Manager High Exfiltration, File System, Alteration, Disruption
Keylogger logoKeylogger High Spy / Surveillance, Credentials
Network Manager logoNetwork Manager High Eavesdropping, Credentials, Disruption, Exfiltration, Lateral Movements
Password Recovery logoPassword Recovery High Privilege Escalation, Credentials, Lateral Movements
Registry Manager logoRegistry Manager High Credentials, Disruption, Exfiltration, Alteration, System Management
Remote Desktop / Screen Capture logoRemote Desktop / Screen Capture High Spy / Surveillance, Assistance
Shell Access logoShell Access High System Management, Privilege Escalation, Lateral Movements
System Information Gathering logoSystem Information Gathering High Privilege Escalation, Spy / Surveillance, Lateral Movements
Voice Recorder logoVoice Recorder High Spy / Surveillance
Webcam Capture logoWebcam Capture High Spy / Surveillance
Process Manager logoProcess Manager Medium System Management, Disruption
Services Manager logoServices Manager Medium Disruption, Privilege Escalation, Assistance
Application / Window Manager logoApplication / Window Manager Low Spy / Surveillance, Disruption

Malware Family References

Other Releases

Version Origins Authors Languages Release Date
DarkComet RAT 1.3 logoDarkComet RAT 1.3 France 🇫🇷 DarkCoderSc Assembly, Delphi Nov, 2009
DarkComet RAT 2.0 RC4 logoDarkComet RAT 2.0 RC4 France 🇫🇷 DarkCoderSc Delphi Mar, 2010
DarkComet RAT 2.0 RC7 logoDarkComet RAT 2.0 RC7 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2010
DarkComet RAT 5.3 logoDarkComet RAT 5.3 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2012
DarkComet RAT 5.3.1 logoDarkComet RAT 5.3.1 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2012
Previous Release Next Release
});