> Family · darkcomet — Commodity Delphi VCL RAT family_

~/packetpursuit $ cat /intel/families/darkcomet.md

typeentityconfidencehighcreated2026-07-10updated2026-07-10malware-familyratc2pedelphiupxpersistencedefense-evasiondiscoveryimpact

darkcomet

Commodity remote-access trojan (RAT) sold as a builder kit, historically attributed to "DarkCoderSc" (Jean-Pierre Lesueur). Built with Borland Delphi 7 / VCL, optionally UPX-packed. Active circa 2008–2015 with periodic resurgences.

Second confirmed sibling: b9b052df (Jul 2026 corpus ingestion) — unpacked non-UPX build, identical Jan 2012 compile timestamp, full v5.x command protocol and surveillance surface exposed without decompression step.

Build Stack

  • Language / compiler: Borland Delphi 7, FastMM Borland Edition RTL ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]
  • GUI framework: VCL (TObject, TComponent, TRegistry, TThread, TCustomControl, TClipboard, TScreen) ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]
  • Packer: Frequently UPX (sections UPX0 / UPX1); some builder variants are unpacked.
  • Version-info masquerade: Default template uses "Microsoft Corp.", "Remote Service Application", InternalName "MSRSAAPP", OriginalFilename "MSRSAAP.EXE", Copyright (C) 1999. ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]
  • Signing: Typically unsigned.

Capabilities

  • registry-run-persistence
  • windows-service-persistence
  • raw-tcp-c2-socket
  • remote-shell-cmd-exe
  • keylogger-offline-online
  • webcam-capture-directshow
  • screenshot-desktop-capture
  • clipboard-hijack
  • browser-credential-harvesting
  • ftp-exfiltration
  • socks5-proxy
  • ddos-syn-flood
  • ddos-udp-flood
  • ddos-http-flood
  • process-list-kill-suspend
  • registry-editor-remote
  • file-manager-upload-download
  • memory-reflective-dll-loader
  • msconfig-startup-registry-manipulation
  • desktop-ui-manipulation-hide-show
  • task-manager-disable-enable

Deploy / TTPs

  • Persistence: Registry Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run), Windows service creation (CreateServiceA/StartServiceA), and MSConfig startup folder/registry manipulation. ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]
  • C2 protocol: Raw TCP over wsock32.dll with a plaintext command protocol. Server commands prefixed with #KCMDDC5#-; bot replies prefixed with #BOT#. ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]
  • Mutex: Configurable via builder; default observed as TMPMUTEX. ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]
  • Grouping key: DC2_USERS string present in client config. ^[/intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html]

Variants / Aliases

  • DarkComet RAT (primary)
  • "MSRSAAPP" (version-info masquerade name)
  • DarkComet-legacy (builder-kit era, pre-2015)
  • DarkComet-RAT-v5.x (command-prefix variant)

Notable Analyses

  • /intel/analyses/a3fa75fe9b9c0ca9ccdc85ae6733024cbc64c545031aad9150f03fed9335850a.html — UPX-packed Delphi VCL stub, MSRSAAPP masquerade, v5.x command prefix (2022-01-15 compile).

Related Entities / Concepts

  • rat — Malware family category: remote-access trojans.
  • delphi-vcl-certificate-harvesting — Delphi VCL RTL bloat pattern shared with other Delphi crimeware families (e.g., nfedigitalcom).
  • registry-run-persistence — Procedure page for T1547.001 via registry Run keys.
  • raw-tcp-c2-socket — Generic raw TCP C2 technique (no application-layer framing).