Featured Image

DarkComet RAT 5.3

Family Name DarkComet RAT
Main Classification Remote Access
Release Version 5.3
Author DarkCoderSc
Origin France 🇫🇷
Affiliation OpenSc.Ws
Languages Delphi , Assembly
Default Port 1604
Release Date Jun, 2012, 14 years ago.

Historical Events / Facts

2017
DarkComet and the Umbrage Project

Leaked CIA documents published by WikiLeaks revealed that the agency's secretive "Umbrage" team actively collected and studied widespread malware, including the DarkComet RAT.

2015
Kevin Mitnick's DarkComet Live Demonstrations

Renowned hacker and cybersecurity consultant Kevin Mitnick frequently utilized the DarkComet RAT to conduct live hacking demonstrations during his security conferences, and was even willing to purchase the project's source code for his professional needs. One of his most notable public showcases took place at the CeBIT 2015 technology trade fair, where he used the tool to actively demonstrate real-world cyber threats to the audience.

2012
The RAT Weaponized Against Syrian Activists

Syrian government weaponized DarkComet to bypass encrypted communications and surveil activists during the civil war. DarkComet was distributed through malicious Skype messages disguised with a fake Facebook icon, secretly installing itself to monitor citizens and reportedly leading to widespread arrests. Upon discovering his tool was being exploited by the Assad regime for state-sponsored espionage, DarkComet's creator immediately and permanently halted the project's development.

Screenshots

Distributed Applications / Files

Spoofer.exe

Spoofer.exe

DarkComet.exe

DarkComet.exe

sqlite3.dll

sqlite3.dll

Key Features

Feature Name Dangerousness Key Categories
Clipboard Manager logoClipboard Manager High Credentials, Exfiltration
Denial Of Service / DDoS logoDenial Of Service / DDoS High Alteration, Disruption
Destructive Operations logoDestructive Operations High Alteration, Disruption
File Manager logoFile Manager High Alteration, File System, Exfiltration, Disruption
Keylogger logoKeylogger High Spy / Surveillance, Credentials
Network Manager logoNetwork Manager High Disruption, Lateral Movements, Exfiltration, Credentials, Eavesdropping
Password Recovery logoPassword Recovery High Lateral Movements, Credentials, Privilege Escalation
Registry Manager logoRegistry Manager High Alteration, System Management, Disruption, Exfiltration, Credentials
Remote Desktop / Screen Capture logoRemote Desktop / Screen Capture High Spy / Surveillance, Assistance
Shell Access logoShell Access High Lateral Movements, Privilege Escalation, System Management
System Information Gathering logoSystem Information Gathering High Spy / Surveillance, Privilege Escalation, Lateral Movements
Voice Recorder logoVoice Recorder High Spy / Surveillance
Webcam Capture logoWebcam Capture High Spy / Surveillance
Process Manager logoProcess Manager Medium System Management, Disruption
Services Manager logoServices Manager Medium Assistance, Privilege Escalation, Disruption
Fun / Troll Functions logoFun / Troll Functions Low Alteration, Disruption

Malware Family References

Other Releases

Version Origins Authors Languages Release Date
DarkComet RAT 1.3 logoDarkComet RAT 1.3 France 🇫🇷 DarkCoderSc Assembly, Delphi Nov, 2009
DarkComet RAT 2.0 RC4 logoDarkComet RAT 2.0 RC4 France 🇫🇷 DarkCoderSc Delphi Mar, 2010
DarkComet RAT 2.0 RC7 logoDarkComet RAT 2.0 RC7 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2010
DarkComet RAT 3.0 logoDarkComet RAT 3.0 France 🇫🇷 DarkCoderSc Assembly, Delphi Nov, 2010
DarkComet RAT 5.3.1 logoDarkComet RAT 5.3.1 France 🇫🇷 DarkCoderSc Assembly, Delphi Jun, 2012
Previous Release Next Release
});