Darkkomet

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Total Surveillance: The RAT allows the attacker to secretly view the victim's webcam, listen to the microphone, capture the desktop screen in real-time, and log every keystroke (keylogger).
• System Administration: The attacker has full GUI-based control over the file system (upload/download/execute), can edit the Windows Registry, manage running processes, and open remote command shells (cmd.exe).
• DDoS and Network Abuse: DarkComet clients can be clustered together by the "botmaster" to launch coordinated Distributed Denial of Service (DDoS) attacks, or utilized as proxy nodes to mask the attacker's true IP address when attacking other targets.

Threat Assessment

Incident Response and Remediation

• Immediate Network Severance: The endpoint must be physically disconnected from the network immediately to kill the active remote session and halt the live exfiltration of video, audio, and files.
• Incident Containment (Lateral Movement): Incident responders must assume the attacker used the DarkComet beachhead to move laterally. Scrutinize Active Directory authentication logs and internal firewall traffic to ensure the attacker did not compromise other servers.
• Total Re-imaging and Credential Wipe: The machine is completely untrusted and must be wiped to bare metal. All credentials used on that machine must be reset globally.

Known aliases

Threat reports may refer to this family under multiple names:

• RAT.DarkComet
• Backdoor.Win32.DarkKomet
• Trojan.DarkComet

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1071.001 T1056.001 T1125

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.001: Implement Endpoint Detection and Response (EDR) to monitor for suspicious API calls related to keystroke interception. Enforce Multi-Factor Authentication (MFA) to render stolen passwords useless.
• T1071.001: Implement web filtering and SSL/TLS inspection to detect malicious command and control (C2) traffic hiding in HTTP/HTTPS.
• T1125: Restrict access to local camera or microphone APIs. Utilize endpoint protection that monitors hardware access.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_DARKKOMET {
    meta:
        description = "Detects Darkkomet (rat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "darkkomet" ascii wide nocase
        $s2 = "rat.darkcomet" ascii wide nocase
        $s3 = "backdoor.win32.darkkomet" ascii wide nocase
        $s4 = "trojan.darkcomet" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Darkkomet Activity
id: cb98c6f555081694a46320ba8ebb6df6
status: experimental
description: Detects generic indicators of the darkkomet malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*darkkomet*"
            - "*rat.darkcomet*"
            - "*backdoor.win32.darkkomet*"
            - "*trojan.darkcomet*"
    condition: selection
level: medium

References & External Analysis

• MITRE ATT&CK: DarkComet (S0334)
• Search "darkkomet" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: rat)

Explore other malware families in the same category:

• Cosmu
• Lolbot
• Nanocore
• Nanobot
• Gh0St

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/darkkomet.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.