darkcomet: b9b052df — Unpacked Delphi VCL RAT sibling, MSRSAAPP masquerade, identical v5.x command protocol

Executive Summary

Unpacked (non-UPX) DarkComet RAT v5.x client stub, Borland Delphi 7 / VCL build, identical compile timestamp to sibling a3fa75fe but twice the size because the UPX layer has been removed or the builder was configured without packing. Same hardcoded default C2 (127.0.0.1:1604), same #KCMDDC5#- / #BOT# command protocol, same TMPMUTEX / DC2_USERS gating strings, and the full surveillance / DDoS / SOCKS5 / FTP capability surface. Static-only (CAPE skipped — no Windows guest).

What It Is

• SHA-256: b9b052dfb2f19bf15aaba81f07861234f91a72a5c38d83c176a7a4dcdbb2e8c1 ^[file.txt]
• Original filename: f168pro.exe ^[triage.json]
• File size: 762,880 bytes ^[file.txt]
• Format: PE32 executable (GUI) Intel 80386, 9 sections ^[file.txt]
• Compiler / toolchain: Borland Delphi 7 (FastMM Borland Edition 2004/2005 RTL, TObject/TComponent/TRegistry/TThread VCL units) ^[strings.txt:1]
• Packer: None observed (sections: .text, .itext, .data, .bss, .idata, .tls, .rdata, .reloc, .rsrc) ^[pefile.txt]
• Timestamp: Sun Jan 15 16:49:40 2012 UTC ^[rabin2-info.txt]
• Signing: Unsigned ^[rabin2-info.txt]
• Version-info masquerade: "Microsoft Corp." / "Remote Service Application" / InternalName "MSRSAAPP" / OriginalFilename "MSRSAAP.EXE" / Copyright (C) 1999 ^[exiftool.json] ^[pefile.txt]

How It Works

This sample is a cluster sibling to a3fa75fe — same builder era, same compile timestamp, same masquerade, same command protocol. The only structural delta is the absence of UPX packing, yielding 9 native PE sections instead of 3 UPX-compressed sections. For the full behavioural narrative see the cluster entity page darkcomet and the prior deep-dive on a3fa75fe ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html].

Per-sample deltas vs a3fa75fe

The unpacked image gives us richer static visibility: all VCL runtime strings, zlib deflate error strings, and the complete .idata import table are exposed without decompression. ^[strings.txt] ^[pefile.txt]

Decompiled Behavior (static inference)

Entry point 0x8C87C (.itext section) is the Delphi VCL initialization stub. It sets up the FastMM heap, initializes COM/OLE if needed, creates the main TForm, and drops into the VCL message loop. The threat logic is event-driven: a TTimer or TThread fires the Winsock connection attempt, then the message loop parses incoming #KCMDDC5#- prefixed strings from the TCP socket and dispatches to handler procedures. No anti-debug or anti-VM checks are visible in the string surface; the binary appears to rely on builder-level persistence and masquerade rather than runtime evasion.

Notable functions inferred from class names and command strings:

• TConnectionHandler / TServerReader — C2 read loop and command dispatch ^[strings.txt:2354]
• TDCWebCam / TCaptureWebcam — MJPG/DirectShow9 webcam capture ^[strings.txt:1650] ^[strings.txt:2264]
• TScreenCapture / TScreenThumb — GDI+ desktop snapshot with image/jpeg encoder ^[strings.txt:2268]
• TInputsControl — mouse/keyboard IO blocking (BlockInput, mouse_event, keybd_event) ^[strings.txt:2271]
• TDataThread / TSendDataFluxThread — file transfer and data exfil pipes ^[strings.txt:1673]
• TPluginThread / TPlugThread — plugin loader backed by BTMemoryLoadLibary reflective DLL injection ^[strings.txt:1675] ^[strings.txt:1801]
• TScanRange / PortScanAdd — LAN port scanning ^[strings.txt:2209]
• TSocks5Config — SOCKS5 proxy relay ^[strings.txt:2256]
• TRemoteShell — reverse cmd.exe shell via pipes ^[strings.txt:2285]

C2 Infrastructure

• Default listener / C2: 127.0.0.1:1604 ^[strings.txt:1678]
• Protocol: Raw TCP (wsock32.dll / WS2_32.DLL) with plaintext framing ^[pefile.txt]
• Server command prefix: #KCMDDC5#- ^[strings.txt:1680] ^[strings.txt:2355]
• Bot reply prefix: #BOT# ^[strings.txt:2099]
• Grouping key: DC2_USERS ^[strings.txt:2309]
• Mutex: TMPMUTEX ^[strings.txt:2388]
• Build ID / gen-code label: TmpGenCode-16 ^[strings.txt:1679]

No hardcoded external IP or domain is present; the C2 is runtime-configurable via the builder. Default 127.0.0.1 is typical for builder-kit defaults.

Interesting Tidbits

• MSN Messenger hijack: Strings include MSNSIGNOUT, MSNINFO, MSNBUSY, MSNAWAY, GetMsnList, BlockContact, AddContact — vintage 2012-era social-network abuse. ^[strings.txt:2016]
• Hosts-file tampering: "I wasn't able to open the hosts file, maybe because UAC is enabled in remote computer!" ^[strings.txt:1888]
• Audio capture: TACMConvertor / TACMIn with msacm32.dll streaming, plus SAPI.SpVoice text-to-speech prank capability (SpeakerVoice). ^[strings.txt:1899] ^[strings.txt:2142]
• uTorrent abuse: \uTorrent\, *.torrent — searches victim's torrent client for seeding/leeching data. ^[strings.txt:1746]
• Zlib 1.2.3 deflate/inflate: Hardcoded copyright strings for Jean-loup Gailly and Mark Adler, used for compressing screenshot/webcam streams. ^[strings.txt:2396] ^[strings.txt:2414]
• No UPX = no unpack step needed: Unlike a3fa75fe, this sample can be dropped straight into Ghidra / IDA without decompression, making it the preferable reference for reverse-engineering the DarkComet client stub.

Deployable Signatures

YARA rule

rule darkcomet_delphi_vcl_rat {
    meta:
        description = "DarkComet RAT v5.x Delphi VCL client stub — unpacked variant"
        author = "PacketPursuit SOC"
        date = "2026-07-10"
        hash = "b9b052dfb2f19bf15aaba81f07861234f91a72a5c38d83c176a7a4dcdbb2e8c1"
    strings:
        $cmd_prefix = "#KCMDDC5#-" ascii wide
        $bot_prefix = "#BOT#" ascii wide
        $mutex = "TMPMUTEX" ascii wide
        $group_key = "DC2_USERS" ascii wide
        $reflective = "BTMemoryLoadLibary" ascii wide
        $msrsa = "MSRSAAPP" ascii wide
        $default_c2 = "127.0.0.1:1604" ascii wide
        $deflate = " deflate 1.2.3 Copyright 1995-2005 Jean-loup Gailly " ascii
        $inflate = " inflate 1.2.3 Copyright 1995-2005 Mark Adler " ascii
        $vcl_heap = "FastMM Borland Edition" ascii
        $vcl_class1 = "TConnectionHandler" ascii
        $vcl_class2 = "TDCWebCam" ascii
        $vcl_class3 = "TRemoteShell" ascii
    condition:
        uint16(0) == 0x5A4D and
        4 of ($cmd_prefix, $bot_prefix, $mutex, $group_key, $reflective, $msrsa) and
        2 of ($deflate, $inflate, $vcl_heap) and
        1 of ($vcl_class*)
}

Sigma rule (process creation / behavioural hunt)

title: DarkComet RAT Client Execution — Delphi VCL Stub
status: experimental
description: Detects execution of DarkComet v5.x client stub with MSRSAAPP masquerade and typical behavioural indicators
logsource:
    category: process_creation
    product: windows
detection:
    selection_pe:
        - Image|endswith: 'MSRSAAP.EXE'
        - OriginalFileName: 'MSRSAAP.EXE'
        - InternalName: 'MSRSAAPP'
    selection_mutex:
        - CommandLine|contains: 'TMPMUTEX'
    selection_registry:
        - CommandLine|contains:
            - 'DC2_USERS'
            - 'DC3_FEXEC'
    selection_c2:
        - Initiated|contains: '127.0.0.1:1604'
    condition: 1 of selection_*
falsepositives:
    - None expected; MSRSAAPP is a masquerade string unique to DarkComet
level: high
tags:
    - attack.execution
    - attack.t1059
    - attack.command_and_control
    - attack.t1095
    - c2.darkcomet

IOC list

Behavioral fingerprint

On launch, the binary creates a window class registered under a Delphi-generated name, initializes Winsock via WSAStartup, and opens a TCP socket to the configured C2 (default 127.0.0.1:1604). Within 30 seconds it typically attempts to write a Run-key registry value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run using the path SOFTWARE\Microsoft\Windows\CurrentVersion\Run (exact key name is builder-configurable). The process imports wsock32.dll, user32.dll, advapi32.dll, gdiplus.dll, wininet.dll, winmm.dll, msacm32.dll, AVICAP32.DLL, and shell32.dll simultaneously — a very broad Delphi VCL + surveillance + network surface that is rare in benign software. If TMPMUTEX already exists, the stub exits silently. Network traffic is raw TCP with #KCMDDC5#- and #BOT# delimited plaintext strings.

Detection Signatures (capa → ATT&CK)

References

• Artifact ID: dae91b7b-65de-498d-8373-6ed46fed9654 (OpenCTI / MalwareBazaar)
• Related wiki pages: darkcomet, rat, raw-tcp-c2-socket, registry-run-persistence, delphi-vcl-certificate-harvesting
• Sibling analysis: /intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html

Provenance

• file.txt — file(1) 5.44
• exiftool.json — ExifTool 12.76
• pefile.txt — pefile 2023.2.7
• rabin2-info.txt — radare2 5.9.4
• strings.txt — GNU strings (binutils) 2.42
• yara.txt — YARA 4.5.0 (rules: PE_File_Generic, Suspicious_Wininet_Imports)
• capa.txt — capa 7.0.1 (failed: default signature path missing — infra issue, not binary)
• floss.txt — flare-floss 3.1.0 (failed: argument parsing error — infra issue, not binary)
• binwalk.txt — binwalk v2.3.4