Technical Information
- [HKCU\Software\Microsoft\Windows\CurrentVersion\Run] 'DarkComet RAT' = '%HOMEPATH%\Documents\DCSCMIN\IMDCSC.exe'
- [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UserInit' = '<SYSTEM32>\userinit.exe,%HOMEPATH%\Documents\DCSCMIN\IMDCSC.exe'
- %APPDATA%\server.exe
- %APPDATA%\nimbuzz forget passwrod by am!r.hack3r.exe
- %HOMEPATH%\documents\dcscmin\imdcsc.exe
- %LOCALAPPDATA%\microsoft\internet explorer\msimgsiz.dat
- 'localhost':1604
- 'bl######ft-amir.blogfa.com':80
- http://bl######ft-amir.blogfa.com/
- http://www.bl##fa.com/static/images/blogfa-logo.gif
- DNS ASK bl######ft-amir.blogfa.com
- DNS ASK ge#.#imbuzz.com
- DNS ASK bl##fa.com
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%APPDATA%\server.exe'
- '%APPDATA%\nimbuzz forget passwrod by am!r.hack3r.exe'
- '%HOMEPATH%\documents\dcscmin\imdcsc.exe'