

Rewterz Threat Alert – Quasar RAT aka CinaRAT – Active IOCs
March 24, 2023
Rewterz Threat Advisory – ICS: Multiple Rockwell Automation ThinManager Vulnerabilities
March 24, 2023
Rewterz Threat Alert – Quasar RAT aka CinaRAT – Active IOCs
March 24, 2023
Rewterz Threat Advisory – ICS: Multiple Rockwell Automation ThinManager Vulnerabilities
March 24, 2023Severity
High
Analysis Summary
DarkComet RAT (Remote Administration Tool) is a type of malware that is designed to allow attackers to gain remote access to a victim’s computer. It was created by a French programmer named Jean-Pierre Lesueur in 2008 and has been widely used by cybercriminals since then.
DarkComet RAT can perform a wide range of malicious activities, including keylogging, file and system manipulation, remote desktop access, and webcam and microphone monitoring. It can also execute arbitrary code on the infected machine, allowing attackers to install additional malware or carry out other attacks. The malware has a wide range of features that make it difficult to detect and remove, including the ability to hide its files and processes, as well as the ability to disable antivirus and other security software. DarkComet RAT can also communicate with its command and control server over multiple communication protocols, making it harder to block or track.
Because of its popularity and powerful capabilities, this RAT has been used in numerous cyber attacks, including targeted attacks on individuals and organizations. It is typically spread through phishing emails, social engineering, and other means of tricking users into downloading and installing the malware. In summary, DarkComet RAT is a dangerous malware that allows attackers to gain complete control of a victim’s computer. It is difficult to detect and remove, making it a persistent threat to individuals and organizations.
Impact
- Unauthorized Access
- Remote command execution
- Theft of Sensitive Information
Indicators of Compromise
MD5
- 4d65bc9a4f4fddc1c6c6e8f69506ef72
- e0c3dc6e59f800b7aa184427011774c8
- 08174d88b1ab8d5c46a86ec40620afb5
SHA-256
- 4c8635fe8e682ac95ccc50a16243ae6064a351121afcadde6f191f09b03c6e40
- bd58067c39932b971f15ac3f3dbbd8d9ebfea5629f058e919535ca02b89f0389
- ddff9a6a442b85be442f9ea366206a77ae95c64216daca2c401d65a861741ff0
SHA-1
- aff9caaf8742ad1e272d0419c76d6a8f2c26336f
- f62e83280567470861088a148083d5a601032c76
- eadc13f3a9afb4b2229fe60f2550c3e4c129115c
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets
- Patch and upgrade any platforms and software timely and make it into a standard security policy.
- Maintain cyber hygiene by updating your anti-virus software and implementing a patch management lifecycle.