MalwarePublished 14 Nov 2025

DarkComet RAT Malware Hidden Inside Fake Bitcoin Tool

Source AlienVault OTX General

Description

DarkComet RAT malware has resurfaced disguised as a fake Bitcoin-related tool, distributed via a RAR archive containing a UPX-packed executable. Upon execution, it installs itself as 'explorer.exe' in the user's AppData folder and establishes persistence through a registry run key. The malware communicates with its command and control server at kvejo991.ddns.net on port 1604. It performs keylogging, storing captured keystrokes in a dedicated folder, and uses process injection into notepad.exe to evade detection. The malware also spawns multiple cmd.exe and conhost.

Impact

For European organizations, the DarkComet RAT poses a medium to high risk, particularly for entities involved in cryptocurrency trading, financial services, or those with employees susceptible to social engineering attacks involving Bitcoin. The malware’s keylogging capability threatens confidentiality by capturing sensitive credentials and personal data. Its persistence mechanisms and process injection techniques can lead to prolonged undetected access, enabling attackers to conduct espionage, data theft, or further network compromise. The spawning of multiple system processes may degrade system performance and complicate incident response. Additionally, the malware’s C2 communications could facilitate lateral movement or deployment of additional payloads. Given the widespread interest and investment in cryptocurrency across Europe, users may be more likely to fall victim to such lures, increasing infection rates. The threat also undermines trust in digital financial tools and may cause reputational damage if breaches become public. While the malware itself does not exploit zero-day vulnerabilities, its effective evasion and persistence tactics can result in significant operational disruption and data loss if not promptly detected and remediated.

Defensive guidance

European organizations should implement layered defenses tailored to this threat. First, deploy advanced endpoint detection and response (EDR) solutions capable of unpacking UPX-packed executables and detecting process injection behaviors, especially targeting notepad.exe and suspicious spawning of cmd.exe and conhost.exe processes. Monitor and alert on creation or modification of registry run keys in user AppData contexts to detect persistence attempts. Network defenses should include blocking and monitoring DNS queries and HTTP traffic to suspicious dynamic DNS domains such as 'kvejo991.ddns.net' and associated IP addresses on non-standard ports like 1604. User awareness training must emphasize the risks of downloading and executing unverified cryptocurrency tools and attachments, highlighting social engineering tactics. Implement strict application whitelisting to prevent execution of unauthorized binaries from user directories. Regularly audit and restrict user privileges to limit malware installation capabilities. Employ behavioral analytics to detect anomalous keylogging activities and unusual process behaviors. Finally, maintain updated threat intelligence feeds to identify and block known file hashes associated with this malware. Incident response plans should be prepared to isolate infected hosts and perform forensic analysis promptly.

Indicators of compromise

Domains 1

kvejo991.ddns.net

URLs 1

http://kvejo991.ddns.net:1604

Hashes 9

46bcf4e361cd251c958720e1198e3f0a
d74ca6016bdde3df525d7c7651747336
dbedd5e7481b84fc5fa82d21aa20106f
57ab0765c97b230c615b43ee4ebc28b674887121
87a2425098d257f4c0450a0cf56d0209963096d4
dc56a542e3db56f1c7132d3e99c960c09396cde3
11bf1088d66bc3a63d16cc9334a05f214a25a47f39713400279e0823c97eb377
58c284e7bbeacb5e1f91596660d33d0407d138ae0be545f59027f8787da75eda
5b5c276ea74e1086e4835221da50865f872fe20cfc5ea9aa6a909a0b0b9a0554

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 14 Nov 2025, 12:46 UTC

MITRE ATT&CK techniques7 from threat tags

Technical details

Indicators of compromise

Domains 1

URLs 1

Hashes 9

Community reviews

Related threats