Categories: Backdoor

What is “Backdoor.DarkComet”?

The Backdoor.DarkComet is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.DarkComet virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Sniffs keystrokes
Interacts with known DarkComet registry keys
Creates known Fynloski/DarkComet mutexes
Anomalous binary characteristics
Contains RAT configuration for DarkComet (see Static Analysis tab)

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Backdoor.DarkComet?


File Info:
crc32: 87CCBDA9md5: e228ec70154ebd0a11ba807f47f329d0name: httpssteamcommunity.comprofiles76561198842393848inventory_2.exesha1: 5a5e22ffad60d3c7dcffff839a899056951971c9sha256: 126ab2eb476d733076dbe309351e0660d049834ec1b0fe65497f5f9c71291a17sha512: ba64cca71ab212df576c7226d2881b9fdc21831ce1492d5fde64155311b417ade60bdef0c301cd6f752a10251305aa69e389fc233d1532e0591b5a8713bf9e16ssdeep: 12288:29HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyF1Rfqa9:SiBIGkbxqEcjsWiDxguehC2SaRiqtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 1999InternalName: MSRSAAPPFileVersion: 1, 0, 0, 1CompanyName: Microsoft Corp.Comments: Remote Service ApplicationProductName: Remote Service ApplicationProductVersion: 4, 0, 0, 0FileDescription: Remote Service ApplicationOriginalFilename: MSRSAAP.EXETranslation: 0x0409 0x04b0

Backdoor.DarkComet also known as:

DrWeb	BackDoor.Tordev.9
MicroWorld-eScan	Gen:Trojan.Heur.2K0@rGDEsgoS
CAT-QuickHeal	Backdoor.Fynloski.A9
McAfee	Generic BackDoor.xa
Cylance	Unsafe
Zillya	Backdoor.DarkKomet.Win32.30209
AegisLab	Trojan.Win32.DarkKomet.tneT
Sangfor	Malware
K7AntiVirus	Trojan ( 004bc4d11 )
BitDefender	Gen:Trojan.Heur.2K0@rGDEsgoS
K7GW	Trojan ( 004bc4d11 )
CrowdStrike	win/malicious_confidence_100% (W)
TrendMicro	BKDR_FYNLOS.SMM
BitDefenderTheta	AI:Packer.1F054B5B1C
F-Prot	W32/Fynloski.BA
Symantec	SMG.Heur!gen
TotalDefense	Win32/Fynloski.A!generic
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.DarkKomet-1
GData	Gen:Trojan.Heur.2K0@rGDEsgoS
Kaspersky	Backdoor.Win32.DarkKomet.aceg
Alibaba	Backdoor:Win32/Fynloski.2627b682
NANO-Antivirus	Trojan.Win32.Tordev.dgnepn
Rising	Backdoor.Pontoeb!1.6637 (CLASSIC)
Ad-Aware	Gen:Trojan.Heur.2K0@rGDEsgoS
Sophos	Troj/Fynlosk-AK
Comodo	Backdoor.Win32.Agent.XAB@4of2bc
F-Secure	Backdoor.BDS/Backdoor.Gen
Baidu	Win32.Backdoor.Agent.l
VIPRE	Backdoor.Win32.Fynloski.A (v)
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.ch
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.e228ec70154ebd0a
Emsisoft	Gen:Trojan.Heur.2K0@rGDEsgoS (B)
SentinelOne	DFI – Malicious PE
Cyren	W32/Fynloski.FWDO-2352
Jiangmin	Backdoor/DarkKomet.lue
Webroot	W32.Trojan.Gen
Avira	BDS/Backdoor.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.DarkKomet
Kingsoft	Win32.Hack.HuigeziT.cz
Endgame	malicious (high confidence)
Arcabit	Trojan.Heur.E33B8F
SUPERAntiSpyware	Backdoor.Fynloski/Variant
ZoneAlarm	Backdoor.Win32.DarkKomet.aceg
Microsoft	Backdoor:Win32/Fynloski.A
AhnLab-V3	Backdoor/Win32.Graybird.R33420
Acronis	suspicious
VBA32	Backdoor.Tordev
MAX	malware (ai score=86)
Malwarebytes	Backdoor.DarkComet
Panda	Trj/Packed.B
Zoner	Trojan.Win32.77859
ESET-NOD32	Win32/Fynloski.AM
TrendMicro-HouseCall	BKDR_FYNLOS.SMM
Tencent	Backdoor.Win32.DarkKomet.zem
Yandex	Trojan.Comet.Gen.LO
Ikarus	Backdoor.Win32.DarkKomet
Fortinet	W32/Generic.AC.1775!tr
AVG	MSIL:GenMalicious-CHX [Trj]
Cybereason	malicious.0154eb
Avast	MSIL:GenMalicious-CHX [Trj]
Qihoo-360	Win32/Backdoor.DarkKomet.B