Legacy Malware Resurfaces: DarkComet RAT Uses Bitcoin Wallet Lure to Deploy UPX-Packed Payload

According to Lat61 Threat Intelligence Team, a new campaign repackages DarkComet RAT with Bitcoin-themed lures to distribute a UPX-packed payload, aiming at cryptocurrency enthusiasts. The operation begins with a RAR archive posing as a legitimate cryptocurrency application, containing a single executable named “94k BTC wallet.exe” that, when run, silently deploys DarkComet RAT and grants full remote control.

Researchers observed the malware uses UPX packing to conceal its code and notes it copies itself to AppData\\Roaming under MSDCSC\\explorer.exe with a Run key to ensure autostart. The DarkComet configuration includes IO Indicators such as a C2 server at kvejo991.ddns[.]net on port 1604 and an installation path of MSDCSC\\explorer.exe, with offline keylogging enabled as part of its persistence.

Keystrokes are logged to a local dclogs folder before exfiltration, and the malware employs process injection by spawning legitimate processes like notepad.exe to host the payload, enabling continued surveillance and control.