DarkCometMalware
- darkkomet
- fynlos
- fynloski
- klovbot
- krademok
DarkComet is one of the most famous RATs, developed by Jean-Pierre Lesueur in 2008. After being used in the Syrian civil war in 2011, Lesuer decided to stop developing the trojan. Indeed, DarkComet is able to enable control over a compromised system through use of a simple graphic user interface. Experts think that this user friendliness is the key of its mass success.From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1055Process Injection
“We do not simply rely on naïve approaches like monitoring well-known system call sequences for process injection, but efficiently analyze memory to find all known evasion capabilities.”
- T1055.004Asynchronous Procedure Call
“It then periodically wakes up, using an asynchronous procedure call, and executes a ROP chain to mark its payload as executable before jumping to it.”
- T1055.012Process Hollowing
“PROCESS HOLLOWING”
What the reports say
1 report, newest first · the exact sentence from each-
Hunting In Memory“DarkComet is one of many malware families that use process hollowing techniques.”
Thanks — we review every report.