darkcomet: a3fa75fe — UPX-packed Delphi VCL RAT, MSRSAAPP masquerade, v5.x command prefix

Executive Summary

Classic DarkComet RAT v5.x built with Borland Delphi 7 / VCL, UPX-packed, and dressed in the family’s trademark "MSRSAAPP / Microsoft Corp." version-info masquerade. The binary carries the full DarkComet capability surface — remote shell, keylogger, webcam capture, screen grab, clipboard hijack, registry editor, FTP, SOCKS5 proxy, and DDoS floods — with the #KCMDDC5#- command prefix and #BOT# bot-control strings hardcoded in the unpacked image. Static-only analysis (CAPE skipped: no Windows guest).

What It Is

• SHA-256: a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a ^[file.txt]
• Original filename: f168pro.exe ^[triage.json]
• File size: 354,816 bytes (UPX-packed) → 762,880 bytes unpacked ^[file.txt]
• Format: PE32 executable (GUI) Intel 80386, 3 sections ^[file.txt]
• Compiler / toolchain: Borland Delphi 7 (FastMM Borland Edition 2004/2005 RTL strings, TObject/TComponent/TRegistry/TThread VCL units) ^[strings.txt]
• Packer: UPX 3.x (sections UPX0, UPX1, entry point 0xCA6B0) ^[pefile.txt]
• Timestamp: Sun Jan 15 16:49:40 2012 UTC ^[rabin2-info.txt]
• Signing: Unsigned ^[rabin2-info.txt]
• Version-info masquerade: "Microsoft Corp." / "Remote Service Application" / "MSRSAAPP" / "MSRSAAP.EXE" / Copyright (C) 1999 ^[exiftool.json] ^[pefile.txt]

How It Works

DarkComet is a commodity remote-access trojan sold as a builder kit; this sample is the client stub produced by the builder. It is not a dropper — the RAT logic is native Delphi, not a staged payload.

On launch the stub reads an embedded plaintext configuration block (keys such as PWD, MUTEX, SID, NETDATA, INSTALL, COMBOPATH) parsed by a Delphi INI-like reader, initializes Winsock, and attempts to connect back to a hardcoded C2 host/port or enters a listen mode. ^[r2:entry0]

The command-and-control surface is exposed through raw TCP sockets (wsock32.dll) overlaid with a simple text protocol. Bot commands begin with #BOT# (e.g., #BOT#Ping, #BOT#VisitUrl, #BOT#CloseServer, #BOT#URLDownload, #BOT#RunPrompt, #BOT#SvrUninstall, #BOT#URLUpdate). Server-side commands use the #KCMDDC5#- prefix. ^[strings.txt]

RAT capabilities observed in strings:

• Surveillance: UntCaptureWebcam, WEBCAMLIVE, ScreenSnap, DESKTOPCAPTURE, SoundCaptureStart, ActiveOfflineKeylogger, ActiveOnlineKeylogger, #GetClipboardText ^[strings.txt]
• System control: KillProcess, Suspend, Resume, Inject, HideTaskBar, ShowTaskBar, DisableTaskMgr, EnableTaskMgr, RegEdit (UntRegEdit), RemoteShell (UntRemoteShell) ^[strings.txt]
• File operations: ADownloadFile, UploadFile, SendFilesToTrash, FindFirstFileA, FindNextFileA ^[strings.txt]
• Network abuse: DDOSSYNFLOOD, DDOSUDPFLOOD, DDOSHTTPFLOOD, ADDSOCKS5, SOCKS5CLOSE, PortScanAdd, FtpPutFileA ^[strings.txt]
• Persistence: SOFTWARE\Microsoft\Windows\CurrentVersion\Run, startupfolder, startupreg, CleanMsConfig, CreateServiceA, StartServiceA ^[strings.txt] ^[pefile.txt]

The binary imports CreateServiceA/StartServiceA/ControlService (ADVAPI32) and registry APIs, supporting both Run-key and Windows-service persistence paths. ^[pefile.txt]

Reflective DLL loading capability is suggested by BTMemoryLoadLibary error strings ("BuildImportTable failed", "VirtualAlloc failed", "IMAGE_NT_SIGNATURE is not valid"), indicating the author included a memory-loader library for plugin injection. ^[strings.txt]

Decompiled Behavior

entry0 at 0x0048c87c (r2 pdc output) shows the classic Delphi initialization sequence:

1. Stack frame setup with 0x28 zero pushes (RTL init).
2. CoInitialize(-1) for COM/OLE support (used by VCL and possibly webcam DirectShow).
3. Calls fcn.004882e8 (likely RTL initialization / unit init chain).
4. Calls fcn.0048b490 which returns a config-object pointer (ebx).
5. Iterates over config keys — PWD, MUTEX, SID, NETDATA, INSTALL, COMBOPATH — fetching each via fcn.0048b548 and storing results in global data references (0x49138c, 0x4912a8, 0x49171c, 0x491644, 0x4912c8, etc.). ^[r2:entry0]

No anti-debug or VM checks were observed in the entry path or in cross-references to IsDebuggerPresent, CheckRemoteDebuggerPresent, or CPUID instructions.

C2 Infrastructure

• Default bind/listen: 127.0.0.1:1604 — likely the builder default before operator customization. ^[strings.txt]
• Protocol: Raw TCP over wsock32.dll (socket, connect, listen, accept, send, recv, gethostbyname).
• No hardcoded external C2 recovered statically. The NETDATA config key would hold the operator-supplied host/port at build time.
• Mutex: TMPMUTEX (configurable via MUTEX key). ^[strings.txt]
• Registry key / group tag: DC2_USERS — observed as a string reference, possibly used for client grouping or as a registry storage key. ^[strings.txt]

Interesting Tidbits

• The MSRSAAPP masquerade is a known DarkComet template; defenders hunting for this specific InternalName have high confidence they are facing DarkComet or a builder-kit derivative. ^[exiftool.json]
• 127.0.0.1:1604 is the default listener port in older DarkComet builder versions (v4.x–v5.x). Samples with this string and no external IP are typically unconfigured builder defaults or test builds.
• The binary embeds zlib 1.2.3 (inflate 1.2.3 Copyright 1995-2005 Mark Adler), likely used for compressing screen-capture streams or file-transfer payloads. ^[strings.txt]
• ACCESS DENIED (x64) string suggests the RAT is 32-bit only and emits a warning when executed on x64 systems for operations requiring WoW64 manipulation. ^[strings.txt]
• BTMemoryLoadLibary strings (note the misspelling "Libary") point to a third-party reflective DLL loader, possibly BTMemoryModule or a fork, used for plugin loading without touching disk.

How To Mess With It (Homelab Replication)

DarkComet is a historic builder-kit RAT. For research purposes:

1. Download the DarkComet v5.3.1 builder (abandoned by author; widely archived in malware-research repositories).
2. Build a stub with default settings — observe the MSRSAAPP version block, TMPMUTEX, and 127.0.0.1:1604 defaults.
3. Compare the resulting PE section names (.itext, .data, .idata, .rdata, .reloc, .rsrc) and import table to this sample.
4. Verification: unpack with upx -d and grep for #KCMDDC5#- and #BOT# — should match.

What you'll learn: How builder-kit defaults create a clusterable static fingerprint even when operators customize C2 addresses.

Deployable Signatures

YARA rule

rule DarkComet_RAT_v5x
{
    meta:
        description = "DarkComet RAT v5.x client stub"
        author = "PacketPursuit"
        date = "2026-07-10"
        sha256 = "a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a"
        reference = "https://malwarebazaar.abuse.ch/sample/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a/"
    strings:
        $cmd_prefix = "#KCMDDC5#-" ascii wide
        $bot_ping = "#BOT#Ping" ascii wide
        $bot_close = "#BOT#CloseServer" ascii wide
        $mutex = "TMPMUTEX" ascii wide
        $dc2 = "DC2_USERS" ascii wide
        $msrsa = "MSRSAAPP" ascii wide
        $btmem = "BTMemoryLoadLibary" ascii wide
        $default_listen = "127.0.0.1:1604" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        4 of them
}

IOC list

Behavioral fingerprint

This 32-bit Delphi PE unpacks to ~763 KB and imports wsock32.dll for raw TCP sockets alongside VCL GUI and DirectShow (webcam) APIs. Within 30 seconds of launch it attempts to resolve NETDATA and MUTEX config values, create a mutex, and open a TCP connection or listening socket on the configured port. Network traffic is plaintext command tokens prefixed with #BOT# (outbound) or #KCMDDC5#- (inbound). File-system indicators include reads to SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg and writes to %TEMP% for downloaded files.

Detection Signatures

References

• Artifact ID: f517207b-28cc-4712-8897-f6325ab97576 ^[metadata.json]
• MalwareBazaar: https://malwarebazaar.abuse.ch/sample/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a/
• MITRE ATT&CK — DarkComet: https://attack.mitre.org/software/S0334/
• DarkComet RAT analysis (Sophos): https://news.sophos.com/en-us/2020/08/05/darkcomet-returns/ (historical reference)

Provenance

• file.txt, exiftool.json, pefile.txt, strings.txt, ssdeep.txt, tlsh.txt, yara.txt, metadata.json, triage.json — generated by triage-fast pipeline, 2026-05-26.
• rabin2-info.txt — radare2 rabin2 -I, 2026-07-10.
• Unpacked with UPX 4.2.2 (upx -d) on 2026-07-10.
• Static strings and imports extracted from unpacked image via strings and radare2 ii / iz.
• Entry-point pseudocode from radare2 pdc @ entry0.
• No dynamic analysis available: CAPE skipped (no Windows guest).