Product Code Database
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur (known as DarkCoderSc), an independent programmer and computer security coder from France. Although the RAT was developed back in 2008, it began to proliferate at the start of 2012. The program was discontinued, partially due to its use in the Syrian civil war to monitor activists but also due to its author's fear of being arrested for unnamed reasons. As of August 2018, the program's development "has ceased indefinitely", and downloads are no longer offered on its official website.
DarkComet allows a user to control the system with a graphical user interface. It has many features which allows a user to use it as administrative remote help tool; however, DarkComet has many features which can be used maliciously. DarkComet is commonly used to spy on the victims by taking screen captures, key-logging, or password stealing.
The RAT was distributed via a "booby-trapped Skype chat message" which consisted of a message with a Facebook icon which was actually an executable file that was designed to install DarkComet. Once infected, the victim's machine would try to send the message to other people with the same booby-trapped Skype chat message.
Once DarkComet was linked to the Assad regime, Lesueur stopped developing the tool, stating, “I never imagined it would be used by a government for spying,” he said. “If I had known that, I would never have created such a tool.”
When DarkComet executes, the server connects to the client and allows the client to control and monitor the server. At this point the client can use any of the features which the GUI contains. A socket is opened on the server and waits to receive packets from the controller, and executes the commands when received. In some cases, the malware may use system utilities to evade detection and gain persistence. For example, it can employ the T1564.001 technique by starting attrib.exe through cmd.exe to hide the main executable.
DarkComet also has some "Fun Features".
Common anti-virus tags for a dark comet application are as follow:
When a computer is infected, it tries to create a connection via Network socket to the controllers computer. Once the connection has been established the infected computer listens for commands from the controller, if the controller sends out a command, the infected computer receives it, and executes whatever function is sent.
|
|
