Procedure examples

DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.

DarkComet has the option to compress its payload using UPX or MPRESS.

DarkComet gathers the username from the victim’s machine.

DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.

DarkComet has a keylogging capability.

DarkComet can list active processes running on the victim’s machine.

DarkComet can execute various types of scripts on the victim’s machine.

DarkComet can launch a remote shell to execute commands on the victim’s machine.

DarkComet can use HTTP for C2 communications.

DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.

DarkComet can load any files onto the infected machine to execute.

DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0” and HKEY_CURRENT_USER\Software\DC3_FEXEC.

DarkComet can steal data from the clipboard.

DarkComet can listen in to victims' conversations through the system’s microphone.

DarkComet can access the victim’s webcam to take pictures.

DarkComet adds several Registry entries to enable automatic execution at every system startup.

DarkComet can disable Security Center functions like anti-virus.

DarkComet can disable Security Center functions like the Windows Firewall.