Description
[DarkComet](https://attack.mitre.org/software/S0334) is a Windows remote administration tool and backdoor.(Citation: TrendMicro DarkComet Sept 2014)(Citation: Malwarebytes DarkComet March 2018)
External References
Techniques Used by This Malware
- T1021.001 — Remote Desktop Protocol
- T1027.002 — Software Packing
- T1033 — System Owner/User Discovery
- T1036.005 — Match Legitimate Resource Name or Location
- T1056.001 — Keylogging
- T1057 — Process Discovery
- T1059 — Command and Scripting Interpreter
- T1059.003 — Windows Command Shell
- T1071.001 — Web Protocols
- T1082 — System Information Discovery
- T1105 — Ingress Tool Transfer
- T1112 — Modify Registry
- T1115 — Clipboard Data
- T1123 — Audio Capture
- T1125 — Video Capture
- T1547.001 — Registry Run Keys / Startup Folder
- T1562.001 — Disable or Modify Tools
- T1562.004 — Disable or Modify System Firewall