DarkComet Experience?
Does anyone out there have experience dealing with DarkComet or detection methods put to DarkComet? If so, anything you'd be willing to share in a comment or private message?
Posted Nov 10, 2015, 5:44 PM UTC
05
I work in the malware research field and am finishing up a graduate degree in that area. I have worked with DarkComet in an academia research project. What questions do you specifically have?
Also, this might be a better question for r/malware.
1
If you look at my reply to the other comment in this thread you'll see some context. Specific questions are what port is typically used, if any, that I can share with my network team so they can check firewall and content filter? Are there any common regkeys changed. I've already looked at hkcu and hklm for anything in startup. I've pulled procs with nothing jumping out to me. Just trying to say whether it is or is not DarkComet.
1
The default port is 1604. Typically RATs are installed via a crypter to evade antivirus detection. An adversary can take the Darkcomet server with a very high AV detection rate, put it through a crypter and make it fully undetectable (FUD), at that time. On launch, the crypter will decrypt and execute the Darkcomet server in memory.
An in-depth analysis on Darkcomet can be found here
1
This is a really odd request. Do you mind letting us know some context so we can better help you?
Fair enough. Supporting K12 schools. Allegations from student A that student B has access to and uses DarkComet. Allegation from principal that her mouse was moving and opening emails. Netstat came back pretty clean, but saw three ports passing through http to some server in Australia. We think VPN and DarkComet, but can't find anything since we made our presence known on the system.