Beware of Fake Bitcoin Tools Concealing DarkComet RAT Malware

A malware campaign is deceiving users by packaging a DarkComet RAT variant inside a RAR archive labelled “94k BTC wallet.exe,” masquerading as a Bitcoin wallet tool to lure downloads. The compressed RAR file (MD5: dbedd5e7481b84fc5fa82d21aa20106f) contains the malicious executable, which is UPX-packed to obscure its true nature and reduce payload size.

After unpacking, the sample (318 KB) decompresses to 725 KB of code, a 43.86% compression ratio, and the binary is revealed to be a DarkComet RAT compiled with Borland Delphi (2006). On execution, the malware creates persistence by copying itself as “explorer.exe” to %AppData%\\Roaming\\MSDCSC\\ and adding an autostart registry entry at HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.

Its configuration hardcodes a C2 infrastructure pointing to kvejo991.ddns[.]net on port 1604, and it uses the mutex “DC_MUTEX-ARULYYD” to ensure a single instance runs. The RAT then performs keystroke logging, storing captured data in a “dclogs” folder before exfiltration to the C2 server, while spawning decoy processes to cloak its payload.