search

zxo2004 / DarkComet-RAT-5.3.1

DarkComet RAT(RemoteAdministrationTool) 5.3.1
170 stars 54 forks source link

Do not download this. #6

Open Integer404 opened 5 months ago

Integer404 commented 5 months ago

heres a couple of reasons why this is a virus

  1. connects to no-ip.com which is often used to manage rats
  2. connects to canyouseeme.org's api which is used to check if a port is open or closed, RATS use ports to connect between computers
  3. modifies multiply regristies including things related to safe boot and the shell
  4. injects into explorer.exe to hide from AV's
  5. loads the FirewallAPI.dll, KernelBase.dll and wow64.dll (wow64 is used to bypass UAC)
  6. runs multiple very suspicious shell commands

if you wanna fuck with the server its running on the ip is 204.79.197.200 heres the virus total link https://www.virustotal.com/gui/file/21ca06b18698d14154a45822aaae1e3837d168cc7630bcd3ec3d8c68aaa959e6

erzurum2525 commented 1 month ago

this is already a rat bro