Darkcomet For Mac
Trojan a blackhole for 'secure' Macs. The bubble that Macintosh is invulnerable to malware may have just been popped thanks to a new tool that appears to be based on the darkComet Windows trojan.
| Developer(s) | Jean-Pierre Lesueur (DarkCoderSc) |
|---|---|
| Final release | |
| Operating system | Microsoft Windows |
| Type | Remote Administration Tool |
| License | freeware |
| Website | https://www.darkcomet-rat.com/[1] |
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur (known as DarkCoderSc[2]), an independent programmer and computer security coder from France. Although the RAT was developed back in 2008, it began to proliferate at the start of 2012. The program was discontinued, partially due to its use in the Syrian civil war to monitor activists but also due to its author's fear of being arrested for unnamed reasons.[1] As of August 2018, the program's development 'has ceased indefinitely', and downloads are no longer offered on its official website.[3]
- Sophos has reported a new “in development” Trojan that’s made specifically to attack Mac machines. The Trojan name from Sophos is OSX/MusMinim-A but the nameless developer calls it Blackhole RAT after the open sourced darkComet RAT that use to plague Windows users.
- Backdoor.DarkComet is a Remote Access Trojan (RAT) application that may run in the background and silently collect information about the system, connected users, and network activity. Backdoor.DarkComet may attempt to steal stored credentials, usernames and passwords, and other personal and confidential information.
DarkComet allows a user to control the system with a graphical user interface. It has many features which allows a user to use it as administrative remote help tool; however, DarkComet has many features which can be used maliciously. DarkComet is commonly used to spy on the victims by taking screen captures, key-logging, or password stealing.
History of DarkComet
Syria
In 2014 DarkComet was linked to the Syrian conflict. People in Syria began using secure connections to bypass the government's censorship and the surveillance of the internet. This caused the Syrian Government to resort to using RATs to spy on its civilians. Many believe that this is what caused the arrests of many activists within Syria.[1]
The RAT was distributed via a 'booby-trapped Skype chat message' which consisted of a message with a Facebook icon which was actually an executable file that was designed to install DarkComet.[4] Once infected, the victim's machine would try to send the message to other people with the same booby-trapped Skype chat message.
Once DarkComet was linked to the Syrian regime, Lesueur stopped developing the tool, stating, “I never imagined it would be used by a government for spying,” he said. “If I had known that, I would never have created such a tool.”[1]
Target Gamers, Military and Governments
In 2012 Arbos Network company found evidence of DarkComet being used to target military and gamers by unknown hackers from Africa. At the time, they mainly targeted the United States.[5]
Je Suis Charlie
In the wake of the January 7, 2015, attack on the Charlie Hebdo magazine in Paris, hackers used the '#JeSuisCharlie' slogan to trick people into downloading DarkComet. DarkComet was disguised as a picture of a newborn baby whose wristband read 'Je suis Charlie.' Once the picture was downloaded, the users became compromised.[6] Hackers took advantage of the disaster to compromise as many systems as possible. DarkComet was spotted within 24 hours of the attack.
Darkcomet For Android
Architecture and Features
Architecture
DarkComet, like many other RATs, uses a reverse-socket architecture. The uninfected computer with a GUI enabling control of infected ones is the client, while the infected systems (without a GUI) are servers.[7]
When DarkComet executes, the server connects to the client and allows the client to control and monitor the server. At this point the client can use any of the features which the GUI contains. A socket is opened on the server and waits to receive packets from the controller, and executes the commands when received.
Features
The following list of features is not exhaustive but are the critical ones that make DarkComet a dangerous tool. Many of these features can be used to completely take over a system and allows the client full access when granted via UAC.
- Spy Functions
- Webcam Capture
- Sound Capture
- Remote Desktop
- Keylogger
- Network Functions
- Active Ports
- Network Shares
- Server Socks5
- LAN Computers
- Net Gateway
- IP Scanner
- Url Download
- Browse Page
- Redirect IP/Port
- WiFi Access Points
- Computer Power
- Poweroff
- Shutdown
- Restart
- Logoff
- Server Actions
- Lock Computer
- Restart Server
- Close Server
- Uninstall Server
- Upload and Execute
- Remote Edit Service
- Update Server
- From URL
- From File
DarkComet also has some 'Fun Features'.
- Fun Features
- Fun Manager
- Piano
- Message Box
- Microsoft Reader
- Remote Chat
Detection
DarkComet is a widely known piece of malware. If a user installs an antivirus, or a darkcomet remover, they can un-infect their computer quickly. Its target machines are typically anything from Windows XP, all the way up to Windows 10.
Common anti-virus tags for a dark comet application are as follow:
- Trojan[Backdoor]/Win32.DarkKomet.xyk
- BDS/DarkKomet.GS
- Backdoor.Win32.DarkKomet!O
- RAT.DarkComet
When a computer is infected, it tries to create a connection via socket to the controllers computer. Once the connection has been established the infected computer listens for commands from the controller, if the controller sends out a command, the infected computer receives it, and executes whatever function is sent.
References
- ^ abcdMcMillan, Robert. 'How the Boy Next Door Accidentally Built a Syrian Spy Tool'. Wired.
- ^'DarkCoderSc | SOLDIERX.COM'. SoldierX. Retrieved 13 October 2017.
- ^'Project definitively closed since 2012'.
DarkComet-RAT development has ceased indefinitely in July 2012. Since the [sic], we do not offer downloads, copies or support.
- ^'Spy code creator kills project after Syrian abuse'. BBC. 10 July 2012.
- ^Wilson, Curt. 'Exterminating the RAT Part I: Dissecting Dark Comet Campaigns'. Arbor.
- ^Vinton, Kate. 'How Hackers Are Using #JeSuisCharlie To Spread Malware'. Forbes.
- ^Denbow, Shawn; Hertz, Jesse. 'pest control: taming the rats'(PDF). Matasano.
External links
- Official website (now defunct)
Malwarebytes removal log
A Malwarebytes log of removal will look similar to this:
Malwarebytes
www.malwarebytes.com
Darkcomet For Macbook Pro
-Log Details-
Scan Date: 3/21/18
Scan Time: 10:22 PM
Log File: 92c470fc-2d88-11e8-afe9-00ffc8517b86.json
Administrator: Yes
-Software Information-
Version: 3.4.4.2398
Components Version: 1.0.322
Update Package Version: 1.0.4442
License: Premium
-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: DE-WIN7Fwiplayer
-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 298073
Threats Detected: 12
Threats Quarantined: 12
Time Elapsed: 2 min, 54 sec
-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect
-Scan Details-
Process: 2
Backdoor.Agent.DC, C:USERSFWIPLAYERDOCUMENTSMSDCSCMSDCSC.EXE, Quarantined, [1570], [218418],1.0.4442
Trojan.Agent, C:USERSFWIPLAYERMY DOCUMENTSMSDCSCMSDCSC.EXE, Quarantined, [17], [218709],1.0.4442
Module: 2
Backdoor.Agent.DC, C:USERSFWIPLAYERDOCUMENTSMSDCSCMSDCSC.EXE, Quarantined, [1570], [218418],1.0.4442
Trojan.Agent, C:USERSFWIPLAYERMY DOCUMENTSMSDCSCMSDCSC.EXE, Quarantined, [17], [218709],1.0.4442
Registry Key: 1
Backdoor.DarkComet.Trace, HKUS-1-5-21-2165681608-3755637219-621560601-1000SOFTWAREDC3_FEXEC, Delete-on-Reboot, [13190], [246706],1.0.4442
Registry Value: 1
Backdoor.Agent.DC, HKUS-1-5-21-2165681608-3755637219-621560601-1000SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONRUN|MicroSystem, Delete-on-Reboot, [1570], [218418],1.0.4442
Registry Data: 2
Backdoor.Agent.DC, HKLMSOFTWAREMICROSOFTWINDOWS NTCURRENTVERSIONWINLOGON|Userinit, Replace-on-Reboot, [1570], [218418],1.0.4442
Hijack.UserInit, HKLMSOFTWAREMICROSOFTWINDOWS NTCURRENTVERSIONWINLOGON|USERINIT, Replace-on-Reboot, [1402], [291753],1.0.4442
Data Stream: 0
(No malicious items detected)
Folder: 0
(No malicious items detected)
Darkcomet For Macbook
File: 4
Backdoor.Agent.DC, C:USERSFWIPLAYERDOCUMENTSMSDCSCMSDCSC.EXE, Delete-on-Reboot, [1570], [218418],1.0.4442
Trojan.Agent, C:USERSFWIPLAYERMY DOCUMENTSMSDCSCMSDCSC.EXE, Delete-on-Reboot, [17], [218709],1.0.4442
Backdoor.DarkComet, C:USERSFWIPLAYERDESKTOP2C0F015C0C1E1F8399E9AE975109D3F8.EXE, Delete-on-Reboot, [328], [500877],1.0.4442
Backdoor.DarkComet, C:USERSFWIPLAYERDOWNLOADS2C0F015C0C1E1F8399E9AE975109D3F8, Delete-on-Reboot, [328], [500877],1.0.4442
Darkcomet For Macbook Air
Physical Sector: 0
(No malicious items detected)