S0334 - DarkComet

DarkComet is a Windows remote administration tool and backdoor.

Author: agomez
Created: 2023-08-14 15:51:59
Last updated: 2026-02-07 18:55:55
Downloads: 393047
IPv4 indicators: 5
Hostname indicators: 200
URL indicators: 29
Sample indicators: 678

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

0.tcp.ngrok.io Hostname

modified 2026-10-17 11:25:40
Malware Download (URLhaus Abuse.ch) · Nanocore RAT (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · MSIL:Bladabindi (Hybrid-Analysis) · Dropped:Generic.Malware.SLlg (Hybrid-Analysis)

https://dosya.co/o70y30olj6pp/dabcat.hile.exe.html URL

modified 2026-10-17 10:33:23
Darkcomet (Triage)

gerfwerng.no-ip.biz Hostname

modified 2026-10-17 08:45:34
DarkComet (ThreatFox Abuse.ch)

n4w.no-ip.info Hostname

modified 2026-10-17 08:41:11
DarkComet (ThreatFox Abuse.ch)

2.tcp.ngrok.io Hostname

modified 2026-10-17 08:40:56
Nanocore RAT (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · Backdoor.Bladabindi (Hybrid-Analysis) · Malware.Generic (Hybrid-Analysis) · MSIL_Bladabindi.A.gen (Hybrid-Analysis)

darkcomet3.no-ip.biz Hostname

modified 2026-10-17 08:40:44
DarkComet (ThreatFox Abuse.ch)

omaromar.zapto.org Hostname

modified 2026-10-17 08:40:30
DarkComet (ThreatFox Abuse.ch)

stickypotent.no-ip.biz Hostname

modified 2026-10-17 08:40:21
DarkComet (ThreatFox Abuse.ch)

gniewkowiec0359.zapto.org Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

unknoxxwn.zapto.org Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

cybergate13.no-ip.org Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

ddoser.no-ip.biz Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

hotguy.zapto.org Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

egegeg.duckdns.org Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

ventoclima.hopto.org Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

zombienetwork.no-ip.net Hostname

modified 2026-10-17 08:38:51
DarkComet (ThreatFox Abuse.ch)

ilya69.no-ip.info Hostname

modified 2026-10-17 08:38:18
DarkComet (ThreatFox Abuse.ch)

soulsmen2000.no-ip.info Hostname

modified 2026-10-17 08:38:00
DarkComet (ThreatFox Abuse.ch)

savesforgames.com Hostname

modified 2026-10-17 06:46:02
Darkcomet (Maltiverse Threat Observatory)

http://savesforgames.com/wp-content/uploads/2017/files/the-chronicles-of-narnia-prince-caspian.rar URL

modified 2026-10-17 06:46:02
Darkcomet (Maltiverse Threat Observatory)

https://dosya.co/0lrulqe674lc/Gta6.exe.html URL

modified 2026-10-17 06:36:26
Darkcomet (Triage)

https://dosya.co/iycbpd2789g4/Vir%C3%BCss%C3%BCz.gta6.bat.html URL

modified 2026-10-17 06:34:12
Darkcomet (Triage)

sitdown.no-ip.biz Hostname

modified 2026-10-17 06:06:25
DarkComet (ThreatFox Abuse.ch)

16b1cf0c65fe7e88dfe42bf7d3bfcde1fa370aa3fe580df8e04c20710eca2cda Sample

modified 2026-10-17 05:02:05
Darkkomet (Cyber Threat Alliance) · Generic Malware (Cyber Threat Alliance)

delta.com.de Hostname

modified 2026-10-17 04:40:19
Malicious URL (Triage) · Darkcomet (Triage) · Darkcomet (Maltiverse Threat Observatory)

batkan20.no-ip.biz Hostname

modified 2026-10-17 04:39:41
DarkComet (ThreatFox Abuse.ch)

interface-alternate.gl.at.ply.gg Hostname

modified 2026-10-17 04:39:36
DarkComet (ThreatFox Abuse.ch)

poohbear.no-ip.org Hostname

modified 2026-10-17 04:37:23
DarkComet (ThreatFox Abuse.ch)

cshm.no-ip.biz Hostname

modified 2026-10-17 04:37:23
DarkComet (ThreatFox Abuse.ch)

wcturkojan.zapto.org Hostname

modified 2026-10-17 04:37:23
Malicious URL (Hybrid-Analysis) · DarkComet (ThreatFox Abuse.ch)

rum.chickenkiller.com Hostname

modified 2026-10-17 04:35:28
DarkComet (ThreatFox Abuse.ch)

lilith.no-ip.biz Hostname

modified 2026-10-17 04:33:21
DarkComet (ThreatFox Abuse.ch)

2026-10-16_fad230ca9a93531f252ac3a36a2a8ca1_amadey_cobalt-strike_coinminer_darkcomet_elex_hijackloader_ransomhub_smoke-loader_stealc_stop_vidar Sample

modified 2026-10-17 01:42:24
Darkcomet (Triage)

cr4nk1337.no-ip.org Hostname

modified 2026-10-17 00:40:32
DarkComet (ThreatFox Abuse.ch)

braxidy.no-ip.org Hostname

modified 2026-10-17 00:40:10
DarkComet (ThreatFox Abuse.ch)

mounir28.no-ip.biz Hostname

modified 2026-10-17 00:40:05
DarkComet (ThreatFox Abuse.ch)

vikky38.no-ip.biz Hostname

modified 2026-10-17 00:39:20
DarkComet (ThreatFox Abuse.ch)

anonymouscheats.no-ip.org Hostname

modified 2026-10-17 00:39:18
DarkComet (ThreatFox Abuse.ch)

kuzhan.no-ip.biz Hostname

modified 2026-10-17 00:38:10
DarkComet (ThreatFox Abuse.ch)

onur11.zapto.org Hostname

modified 2026-10-17 00:37:31
DarkComet (ThreatFox Abuse.ch)

fikohack.no-ip.biz Hostname

modified 2026-10-17 00:37:08
DarkComet (ThreatFox Abuse.ch)

limboland1.no-ip.biz Hostname

modified 2026-10-17 00:37:08
DarkComet (ThreatFox Abuse.ch)

darkcomet9912.no-ip.biz Hostname

modified 2026-10-17 00:37:08
DarkComet (ThreatFox Abuse.ch)

gremioo1903.no-ip.org Hostname

modified 2026-10-17 00:36:41
DarkComet (ThreatFox Abuse.ch)

afamagwazia.chickenkiller.com Hostname

modified 2026-10-17 00:36:36
DarkComet (ThreatFox Abuse.ch)

aris617.no-ip.org Hostname

modified 2026-10-17 00:36:28
DarkComet (ThreatFox Abuse.ch)

matt.no-ip.biz Hostname

modified 2026-10-17 00:33:54
DarkComet (ThreatFox Abuse.ch)

afamagwazia2015.chickenkiller.com Hostname

modified 2026-10-17 00:33:54
DarkComet (ThreatFox Abuse.ch)

hnoo0oody.zapto.org Hostname

modified 2026-10-17 00:33:28
DarkComet (ThreatFox Abuse.ch)

nostradame37.no-ip.biz Hostname

modified 2026-10-17 00:33:03
DarkComet (ThreatFox Abuse.ch)

www.onceokuloncesi.com Hostname

modified 2026-10-16 20:46:40
Malware site (Hybrid-Analysis) · Darkcomet (Maltiverse Threat Observatory)

http://www.onceokuloncesi.com/secoload/uploads/173259/2014-03-23/02-24/okul_oncesi_oyunlar.exe URL

modified 2026-10-16 20:46:40
Darkcomet (Maltiverse Threat Observatory)

milanilou007.ddns.me Hostname

modified 2026-10-16 20:40:41
DarkComet (ThreatFox Abuse.ch)

diyarbakir.no-ip.biz Hostname

modified 2026-10-16 20:40:20
DarkComet (ThreatFox Abuse.ch)

eselreiter.no-ip.biz Hostname

modified 2026-10-16 20:40:10
DarkComet (ThreatFox Abuse.ch)

doulnulla.serveblog.net Hostname

modified 2026-10-16 20:39:57
DarkComet (ThreatFox Abuse.ch)

jtmftw.no-ip.biz Hostname

modified 2026-10-16 20:39:13
DarkComet (ThreatFox Abuse.ch)

amcalar.123.duckdns.org Hostname

modified 2026-10-16 20:39:06
DarkComet (ThreatFox Abuse.ch)

darkcomettr.no-ip.org Hostname

modified 2026-10-16 20:38:09
DarkComet (ThreatFox Abuse.ch)

lebkuchen.no-ip.org Hostname

modified 2026-10-16 20:38:09
DarkComet (ThreatFox Abuse.ch)

h5n1.ddns.net Hostname

modified 2026-10-16 20:37:56
DarkComet (ThreatFox Abuse.ch)

robotix.dyndns.info Hostname

modified 2026-10-16 20:37:56
DarkComet (ThreatFox Abuse.ch)

belhadj47.no-ip.biz Hostname

modified 2026-10-16 20:37:02
Botnet C&C (Microsoft) · DarkComet (ThreatFox Abuse.ch)

xxt0xic.no-ip.biz Hostname

modified 2026-10-16 20:36:04
DarkComet (ThreatFox Abuse.ch)

daniele2.no-ip.info Hostname

modified 2026-10-16 20:36:03
DarkComet (ThreatFox Abuse.ch)

arpej.duckdns.org Hostname

modified 2026-10-16 20:35:54
DarkComet (ThreatFox Abuse.ch)

larissa.no-ip.biz Hostname

modified 2026-10-16 20:35:39
DarkComet (ThreatFox Abuse.ch)

numberoneminecraft.serveminecraft.net Hostname

modified 2026-10-16 20:35:39
DarkComet (ThreatFox Abuse.ch)

rattatattat.no-ip.biz Hostname

modified 2026-10-16 20:35:14
DarkComet (ThreatFox Abuse.ch)

https://dosya.co/1el0yunvgzhb/discord_token_chechker.exe.html URL

modified 2026-10-16 18:36:03
Darkcomet (Triage)

2026-10-15_4ac26eb560f544e3a984bc2d890fafe8_amadey_cobalt-strike_darkcomet_elex_hijackloader_ransomhub_smoke-loader_stealc_stop_vidar Sample

modified 2026-10-16 17:14:56
Darkcomet (Triage)

error404.no-ip.info Hostname

modified 2026-10-16 16:36:38
DarkComet (ThreatFox Abuse.ch)

hostnummer1number1.zapto.org Hostname

modified 2026-10-16 16:36:23
DarkComet (ThreatFox Abuse.ch)

1zkiller.no-ip.org Hostname

modified 2026-10-16 16:35:27
DarkComet (ThreatFox Abuse.ch)

playgroundhq.no-ip.org Hostname

modified 2026-10-16 16:34:54
DarkComet (ThreatFox Abuse.ch)

2.tcp.eu.ngrok.io Hostname

modified 2026-10-16 16:33:36
Nanocore RAT (ThreatFox Abuse.ch) · RedLine Stealer (ThreatFox Abuse.ch) · Backdoor.DarkKomet (Hybrid-Analysis) · Generic.MSIL.PasswordStealerA (Hybrid-Analysis) · Malicious URL (Hybrid-Analysis)

anonymous-hr.zapto.org Hostname

modified 2026-10-16 16:33:26
DarkComet (ThreatFox Abuse.ch)

moehome.dyndns.org Hostname

modified 2026-10-16 16:33:26
DarkComet (ThreatFox Abuse.ch)

91.132.49.90 IPv4

modified 2026-10-16 16:18:47
DarkComet (ThreatFox Abuse.ch) · Malicious Host (HoneyDB) · Empty reason (Blocklist.net.ua) · Unauthorized scanning of hosts (Blocklist.net.ua)

aefdb8d8db45ee493cd06c0376fbf553e48970717f2793a539742d0c46d5cf2e Sample

modified 2026-10-16 15:29:52
Fynloski (Cyber Threat Alliance)

123123yourmothergentlemen.chickenkiller.com Hostname

modified 2026-10-16 15:18:33
DarkComet (ThreatFox Abuse.ch)

zapd.zapto.org Hostname

modified 2026-10-16 14:01:51
DarkComet (ThreatFox Abuse.ch)

2026-10-15_73a53e85e86537d0957a5d1e4df7afe2_amadey_cobalt-strike_darkcomet_elex_hijackloader_ransomhub_smoke-loader_stealc_stop_vidar Sample

modified 2026-10-16 13:17:06
Darkcomet (Triage)

hellberg.no-ip.biz Hostname

modified 2026-10-16 12:37:16
DarkComet (ThreatFox Abuse.ch)

noip81.no-ip.biz Hostname

modified 2026-10-16 12:37:02
DarkComet (ThreatFox Abuse.ch)

kumarrr.no-ip.org Hostname

modified 2026-10-16 12:36:10
DarkComet (ThreatFox Abuse.ch)

shizzlekid.zapto.org Hostname

modified 2026-10-16 12:34:22
DarkComet (ThreatFox Abuse.ch)

sound-educated.gl.at.ply.gg Hostname

modified 2026-10-16 12:33:44
DarkComet (ThreatFox Abuse.ch)

12345.no-ip.biz Hostname

modified 2026-10-16 12:31:39
DarkComet (ThreatFox Abuse.ch)

jaffacakes118_HEUR.Trojan.Win32.Generic.0c35668baa4cc7753b583d50787dafbc Sample

modified 2026-10-16 11:10:57
Darkcomet (Triage)

jaffacakes118_Backdoor.Win32.Delf.abls.cc223c0c50920354078efa811ec9799a Sample

modified 2026-10-16 10:55:32
Darkcomet (Triage)

jaffacakes118_Backdoor.Win32.DarkKomet.xyk.9c601a07eb0af55f11783 Sample

modified 2026-10-16 10:55:26
Darkcomet (Triage)

jaffacakes118_Backdoor.Win32.DarkKomet.bhfh.0571bec55066e580e93d920119da8a65 Sample

modified 2026-10-16 10:55:13
Darkcomet (Triage)

jaffacakes118_Backdoor.Win32.DarkKomet.aceg.a95a56bc642facb461b9c Sample

modified 2026-10-16 10:55:07
Darkcomet (Triage)

jaffacakes118_Backdoor.Win32.DarkKomet.aaqd.d5cae9233aa237d068dc668ac274dfb5 Sample

modified 2026-10-16 10:55:01
Darkcomet (Triage)

pil0.sytes.net Hostname

modified 2026-10-16 10:24:50
DarkComet (ThreatFox Abuse.ch)

goodeal.zapto.org Hostname

modified 2026-10-16 09:25:15
DarkComet (ThreatFox Abuse.ch)

hf1.no-ip.biz Hostname

modified 2026-10-16 08:42:02
DarkComet (ThreatFox Abuse.ch)

derkleinestinker.no-ip.info Hostname

modified 2026-10-16 08:39:59
DarkComet (ThreatFox Abuse.ch)

cinar12322-26444.portmap.host Hostname

modified 2026-10-16 08:37:34
DarkComet (ThreatFox Abuse.ch)