Dark Matter: Uncovering the DarkComet RAT Ecosystem

Brown Farinholt, Mohammad Rezaeirad, Damon McCoy, Kirill Levchenko

    Research output: Chapter in Book/Report/Conference proceedingConference contribution

    Abstract

    Remote Access Trojans (RATs) are a persistent class of malware that give an attacker direct, interactive access to a victim's personal computer, allowing the attacker to steal private data, spy on the victim in real-time using the camera and microphone, and verbally harass the victim through the speaker. To date, the users and victims of this pernicious form of malware have been challenging to observe in the wild due to the unobtrusive nature of infections. In this work, we report the results of a longitudinal study of the DarkComet RAT ecosystem. Using a known method for collecting victim log databases from DarkComet controllers, we present novel techniques for tracking RAT controllers across hostname changes and improve on established techniques for filtering spurious victim records caused by scanners and sandboxed malware executions. We downloaded 6,620 DarkComet databases from 1,029 unique controllers spanning over 5 years of operation. Our analysis shows that there have been at least 57,805 victims of DarkComet over this period, with 69 new victims infected every day; many of whose keystrokes have been captured, actions recorded, and webcams monitored during this time. Our methodologies for more precisely identifying campaigns and victims could potentially be useful for improving the efficiency and efficacy of victim cleanup efforts and prioritization of law enforcement investigations.

    Original languageEnglish (US)
    Title of host publicationThe Web Conference 2020 - Proceedings of the World Wide Web Conference, WWW 2020
    PublisherAssociation for Computing Machinery, Inc
    Pages2109-2120
    Number of pages12
    ISBN (Electronic)9781450370233
    DOIs
    StatePublished - Apr 20 2020
    Event29th International World Wide Web Conference, WWW 2020 - Taipei, Taiwan, Province of China
    Duration: Apr 20 2020Apr 24 2020

    Publication series

    NameThe Web Conference 2020 - Proceedings of the World Wide Web Conference, WWW 2020

    Conference

    Conference29th International World Wide Web Conference, WWW 2020
    CountryTaiwan, Province of China
    CityTaipei
    Period4/20/204/24/20

    Keywords

    • malware
    • remote access trojan
    • security

    ASJC Scopus subject areas

    • Computer Networks and Communications
    • Software

    Fingerprint Dive into the research topics of 'Dark Matter: Uncovering the DarkComet RAT Ecosystem'. Together they form a unique fingerprint.

    Cite this