1. DarkComet RAT
Overview
Author: Jean-Pierre LesueurEra: ~2008–2015Victims: Individuals, activists, enterprises, governmentsNotable Use: Surveillance during the Arab Spring
DarkComet was originally marketed as a “remote administration tool” but became one of the most abused RATs due to its ease of use and rich spying features .
Infection Vector
Phishing emails with:
Malicious EXE
ZIP/RAR attachments
Trojanized software
USB propagation
Capabilities
Full remote desktop control
Keylogging
Webcam & microphone access
File manager
Credential theft
Registry editing
DDoS module
Persistence Mechanisms
Registry Run keys
Startup folder
Copy to %APPDATA% or %TEMP%
C2 Communication
Custom TCP protocol
Configured static IP/domain
Optional password-protected C2
Representative IOCs (DarkComet)
File-Based
Type Example File Name svchost.exe, server.exeFile Path %APPDATA%\Microsoft\svchost.exeHash (Example) 5f4dcc3b5aa765d61d8327deb882cf99
Registry
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\DarkComet
Network
Indicator Example Port 1604 TCP User-Agent None / Custom Traffic Long-lived TCP sessions
2. Gh0st RAT
Overview
Origin: ChinaEra: ~2008–Present (variants)Victims: Governments, defense, NGOsAssociated With: Cyber-espionage / APT activity
Gh0st RAT is known for its modular architecture and use in targeted espionage campaigns .
Infection Vector
Spear-phishing with malicious documents
Exploits (older campaigns)
Trojanized installers
Capabilities
Live screen viewing
Audio surveillance
Keystroke logging
File exfiltration
Process management
Proxy tunneling
Persistence Mechanisms
Windows services
Registry autoruns
DLL side-loading
C2 Communication
Encrypted TCP
Often uses port 80/443 to blend in
Custom binary protocol
Representative IOCs (Gh0st RAT)
File-Based
Type Example File Name msupdate.exe, svhost.dllPath %SYSTEM32%\msupdate.exeHash (Example) d41d8cd98f00b204e9800998ecf8427e
Registry
Key HKLM\SYSTEM\CurrentControlSet\Services\msupdate
Network
Indicator Example C2 Port 80, 443 Traffic Pattern Encrypted binary blobs Beaconing Low and stealthy
3. njRAT (a.k.a. Bladabindi)
Overview
Origin: Middle East (commonly attributed)Era: ~2013–PresentVictims: SMBs, individuals, enterprisesNotable Trait: Massive scale & automation
njRAT is one of the most widespread commodity RATs , often used in financially motivated campaigns.
Infection Vector
Phishing emails
Fake software cracks
Drive-by downloads
Social media file sharing
Capabilities
Remote shell
Credential dumping
Keylogging
Screenshot capture
File upload/download
USB spreading
Persistence Mechanisms
Registry Run keys
Scheduled Tasks
Copy to %APPDATA%
C2 Communication
HTTP
Dynamic DNS (No-IP, DuckDNS)
Base64-encoded traffic
Representative IOCs (njRAT)
File-Based
Type Example File Name server.exe, winlogon.exePath %APPDATA%\Roaming\Microsoft\winlogon.exeHash (Example) e99a18c428cb38d5f260853678922e03
Registry
Key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\njRAT
Network
Indicator Example Domain example.ddns.netHTTP Pattern POST /index.phpData Base64 blobs
4. MITRE ATT&CK Mapping (Common Across All)
Tactic Technique Initial Access Phishing Attachment (T1566.001) Persistence Registry Run Keys (T1547.001) Privilege Escalation Credential Dumping (T1003) Defense Evasion Obfuscated Files (T1027) C2 Web Protocols (T1071.001) Exfiltration Over C2 Channel (T1041)
5. SOC Detection & Hunting Tips
Endpoint
Look for unsigned binaries with outbound connections
Monitor registry autoruns
Detect keylogging APIs
Network
Identify periodic beaconing
Alert on Dynamic DNS usage
TLS inspection for anomalous certs
6. Comparative Summary Table
Feature DarkComet Gh0st RAT njRAT Targeting Broad Targeted/APT Mass-scale C2 TCP Encrypted TCP HTTP Persistence Registry Services Registry/Tasks Key Feature Webcam spying Espionage Automation Skill Level Low–Medium High Low Usage Today Rare Modified variants Still common
Why Static IOCs Alone Are Insufficient
IOC Type Why It Fails File Hash Changes per compilation File Name Randomized IP Address Fast-flux / VPS rotation Domain Dynamic DNS / DGA Registry Key Randomized paths User-Agent Easily spoofed
Static IOCs = tactical, not strategic detection
Modern RAT Detection Strategy (Layered)
1. Behavioral Detection (Most Important)
Behavioral detection focuses on what malware does , not how it looks.
Key RAT Behaviors
Behavior Example Persistence Creation Registry Run keys, tasks Keylogging Keyboard hooks Screen Capture GDI / DirectX abuse Credential Access LSASS access Process Injection WriteProcessMemoryBeaconing Regular outbound traffic LOLbin Abuse PowerShell, rundll32
Example Behavioral Signals
Non-UI process capturing screenshots
Office app spawning PowerShell → network
Unsigned process injecting into explorer.exe
➡️ Resilient against recompilation
2. Threat Hunting (Proactive)
Threat hunting assumes compromise may already exist .
RAT-Focused Hunting Hypotheses
Hypothesis Hunt Idea RAT persistence exists Search autoruns RAT beaconing present Find periodic traffic RAT in memory Look for injected code RAT stole creds LSASS access events RAT lateral movement SMB/RDP anomalies
Example Hunt Queries (Conceptual)
Processes with:
Network access + no disk file
Unsigned + long runtime
Scheduled tasks with random names
Outbound connections to Dynamic DNS
➡️ Finds unknown & custom RATs
3. EDR Telemetry (High-Fidelity)
EDR provides deep visibility across endpoints.
Key Telemetry Sources
Telemetry Value Process Creation Parent-child anomalies Command Line Obfuscation detection Memory Injection indicators File Writes Suspicious locations Registry Autorun creation Network Per-process traffic
RAT Detection via EDR
Signal Why It Matters Office → Script → Network Classic RAT loader svchost.exe outboundSuspicious Unsigned service install Persistence API hooking Keylogging
➡️ EDR correlates events across time
4. Threat Intelligence Correlation
Threat intelligence adds context , not just IOCs.
What to Correlate
Intelligence Type Usage Known TTPs Map behavior to malware families Infrastructure Patterns Hosting providers Campaign Context Who/why targeting Malware Lineage RAT variants Timing Active campaigns
Example Correlation
Behavioral pattern matches njRAT
Domain registered recently + Dynamic DNS
Hosting in known bulletproof ASN
Matches MITRE techniques used by njRAT
➡️ Turns signals into attribution & confidence
How These Four Work Together (Example)
Scenario
No known hash
No known domain
Detection Flow
Behavioral Detection
Registry Run key created
Keylogging APIs used
EDR Telemetry
Process injected into explorer.exe
Periodic HTTPS beacons
Threat Hunting
Find similar persistence across hosts
Threat Intelligence
Behavior maps to commodity RAT family
➡️ Detection succeeds without static IOCs
Detection Maturity Comparison
Approach Effectiveness Static IOCs Only Low IOCs + AV Limited Behavioral + EDR High Hunting + TI + EDR Very High
Recommended Blue-Team RAT Defense Model
Layer Action Endpoint EDR with behavior rules Network Beaconing & DNS analytics Identity MFA & credential monitoring SOC Continuous hunting Intel TTP-focused feeds
