Categories: Backdoor

Backdoor.Win32.DarkKomet.iicc removal

The Backdoor.Win32.DarkKomet.iicc is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor.Win32.DarkKomet.iicc virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Creates RWX memory
Drops a binary and executes it
Uses Windows utilities for basic functionality
Sniffs keystrokes
Installs itself for autorun at Windows startup
Creates a copy of itself
Interacts with known DarkComet registry keys
Contains RAT configuration for DarkComet (see Static Analysis tab)

How to determine Backdoor.Win32.DarkKomet.iicc?


File Info:
crc32: 6A609EC8md5: 68e3236ee4103ea6cba4751b825a3c2ename: 68E3236EE4103EA6CBA4751B825A3C2E.mlwsha1: 7f0cb24a9b88e0e7f226c5adebc8185a807524f6sha256: f696bb0ca1c8c2d9fc4a65cacafd614945e657c262926d34f18dfe4a958ced7dsha512: 0537e1c7656dca8d408d62711f6ad43fe7ea53d450d1b9149432bc5afc8eff8acc87e5d5c359940dc62236d8e7f1c4653358ba5d39b35c7d9778a815ffe60fb8ssdeep: 12288:y9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h5:eZ1xuVVjfFoynPaVBUR8f+kN10EB3type: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright (C) 1999InternalName: MSRSAAPPFileVersion: 1, 0, 0, 1CompanyName: Microsoft Corp.Comments: Remote Service ApplicationProductName: Remote Service ApplicationProductVersion: 4, 0, 0, 0FileDescription: Remote Service ApplicationOriginalFilename: MSRSAAP.EXETranslation: 0x0409 0x04b0

Backdoor.Win32.DarkKomet.iicc also known as:

Bkav	W32.FamVT.DeagezLQ.Trojan
Elastic	malicious (high confidence)
DrWeb	BackDoor.Tordev.976
ClamAV	Win.Trojan.DarkKomet-1
CAT-QuickHeal	Backdoor.Fynloski.A9
ALYac	Trojan.Inject.AUZ
Cylance	Unsafe
Zillya	Backdoor.DarkKomet.Win32.30208
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Backdoor ( 003b505d1 )
K7AntiVirus	Backdoor ( 003b505d1 )
Baidu	Win32.Backdoor.Agent.l
Cyren	W32/Downloader.C.gen!Eldorado
Symantec	Backdoor.Graybird
ESET-NOD32	Win32/Fynloski.AA
Zoner	Trojan.Win32.88734
APEX	Malicious
Avast	MSIL:GenMalicious-CHX [Trj]
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.DarkKomet.iicc
BitDefender	Trojan.Inject.AUZ
NANO-Antivirus	Trojan.Win32.DarkKomet.ecawjb
ViRobot	Backdoor.Win32.Agent.674304.A
MicroWorld-eScan	Trojan.Inject.AUZ
Tencent	Backdoor.Win32.Darkkomet.a
Ad-Aware	Trojan.Inject.AUZ
Sophos	ML/PE-A + Troj/Backdr-ID
Comodo	Backdoor.Win32.Agent.XAB@4of2bc
F-Secure	Backdoor.BDS/DarkKomet.GS
BitDefenderTheta	AI:Packer.5A8EF8D41C
VIPRE	Trojan.Win32.Generic!SB.0
TrendMicro	BKDR_FYNLOS.SMM
McAfee-GW-Edition	BehavesLike.Win32.Backdoor.jh
FireEye	Generic.mg.68e3236ee4103ea6
Emsisoft	Trojan.Fynloski (A)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Generic.adygq
Webroot
Avira	BDS/DarkKomet.GS
eGambit	RAT.DarkComet
Antiy-AVL	Trojan/Generic.ASBOL.D9B
Microsoft	Backdoor:Win32/Fynloski.PA!MTB
Gridinsoft	Backdoor.Win32.Fynloski.zv!n
Arcabit	Trojan.Inject.AUZ
SUPERAntiSpyware	Backdoor.Fynloski/Variant
GData	Win32.Backdoor.DarkComet.H
TACHYON	Backdoor/W32.DP-DarkKomet.674304
AhnLab-V3	Win-Trojan/Keylogger.679832
Acronis	suspicious
McAfee	Generic BackDoor.xa
MAX	malware (ai score=85)
VBA32	Backdoor.DarkKomet
Malwarebytes	Spyware.KeyLogger
Panda	Trj/Packed.B
TrendMicro-HouseCall	BKDR_FYNLOS.SMM
Rising	Backdoor.DarkComet!1.CB87 (CLASSIC)
Yandex	Trojan.Comet.Gen.LO
Ikarus	Backdoor.Win32.DarkKomet
MaxSecure	Backdoor.DarkComet
Fortinet	W32/Generic.AC.25E!tr
AVG	MSIL:GenMalicious-CHX [Trj]