⚠

DarkComet

rat4 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

DarkComet

CATEGORY:

RAT

DESCRIPTION:

DarkComet is a long-standing and feature-rich Remote Access Trojan (RAT) that has been used by various threat actors for years. It provides extensive capabilities for remote control, surveillance, and data theft.

ALIASES:

DarkComet RATdarkkomet

TAGS:

remote_accesscommodity_RATkeylogginginfostealerc2

[MUTEX_SIGNATURES](4)

[MUTEX_01]

DC_MUTEX-<7 Alphanumeric Characters>

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://blog.talosintelligence.com/ding-your-rat-has-been-delivered/

https://any.run/cybersecurity-blog/darkcomet-rat-technical-analysis/

[MUTEX_02]

DCMIN_MUTEX-<7 Alphanumeric Characters>

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://blog.talosintelligence.com/threat-roundup-0122/

[MUTEX_03]

DCMUTEX

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://blog.talosintelligence.com/threat-roundup-0122/

[MUTEX_04]

DCPERSFWBP

ANALYST: @adhikara13 DATE: 2024-08-01

REFERENCES:

https://tria.ge/240426-n1ymfsba99/behavioral2/analog?q=DCPERSFWBP&main_event=Mutex

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2008

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:4

THREAT_ACTORS:1

ALIASES:2

TAGS:5

CATEGORY:RAT

Malware profile loaded successfully