DarkComet

Malware & Tools · DarkComet

· MalwareS0334 · Zararlı Yazılım

Type

malware

Techniques

Used By

3 groups

Platforms

Windows

Description

DarkComet is a Windows remote administration tool and backdoor.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)

Tactic Coverage

collection (4)discovery (3)defense impairment (3)stealth (2)execution (2)command and control (2)persistence (2)lateral movement (1)credential access (1)privilege escalation (1)

Used By (3 groups)

G0082APT38NICKEL GLADSTONE, BeagleBoyz G0083SilverTerrier G0134Transparent TribeCOPPER FIELDSTONE, APT36

Techniques (18)

T1021.001Remote Desktop Protocol

lateral movement

T1027.002Software Packing

stealth

T1033System Owner/User Discovery

discovery

T1036.005Match Legitimate Resource Name or Location

stealth

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

References

https://attack.mitre.org/software/S0334 https://blog.malwarebytes.com/threat-analysis/2012/06/you-dirty-rat-part-1-darkcomet/https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/DARKCOMET