{
  "family": "cometer",
  "sample_count": 37,
  "category": "rat",
  "description": "Cometer (cataloged across security intelligence feeds under signatures such as Backdoor:Win32/Cometer, Trojan:Win32/Cometer, and Backdoor.Win32.Cometer) is a prominent remote access trojan (RAT) and backdoor closely related to the DarkComet codebase, active since 2012. Engineered to grant threat actors total interactive control over compromised Windows endpoints, Cometer is typically delivered through trojanized software downloads, weaponized file archives, and phishing emails. Once active, Cometer establishes persistence via Windows registry Run keys, opens an encrypted reverse TCP communication channel to remote command servers, and initializes surveillance modules including keystroke logging, webcam and microphone capture, live desktop streaming, remote file management, and process manipulation.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor:Win32/Cometer",
    "Trojan:Win32/Cometer",
    "Backdoor.Win32.Cometer",
    "Win32/Cometer",
    "Trojan.Cometer"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Backdoor:Win32/Cometer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cometer is a remote access trojan derived from the DarkComet family that provides attackers with unauthorized remote administrative control over infected systems."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities does Cometer have?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Cometer includes keylogging, audio and webcam capture, desktop screenshots, remote shell execution, and file system exploration."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cometer maintain persistence on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes startup entries into the CurrentVersion\\Run registry keys and registers itself as a background service or startup folder shortcut."
      }
    },
    {
      "@type": "Question",
      "name": "How does Cometer communicate with its controller?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It establishes outbound reverse TCP connections over designated ports (often 1604 or 8080) using RC4-encrypted network packets."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against Cometer RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy modern EDR solutions to detect keylogger hooks and unauthorized camera activations, restrict execution of unknown executables, and block anomalous outbound TCP ports."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1056.001",
    "T1113",
    "T1125",
    "T1059.003",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2012,
  "threat_actor": null,
  "delivery_mechanism": [
    "Phishing Emails with Trojanized Attachments",
    "P2P Software Downloads & Cracks",
    "Malicious Malvertising Portals"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Keystroke Logging & Clipboard Scraping",
    "Live Remote Desktop Streaming",
    "Webcam & Audio Microphone Interception",
    "Remote Command Shell Execution",
    "Arbitrary File Upload and Download"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi/C++)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Persistent outbound TCP sessions on custom ports (e.g. 1604, 8080) utilizing proprietary RC4-encrypted beaconing protocols",
      "Keepalive heartbeat packets carrying host system specs and active window titles"
    ],
    "evasion_techniques": [
      "Injecting surveillance threads into explorer.exe or svchost.exe",
      "Disabling Task Manager, Registry Editor, and Windows Firewall via registry policy tampering"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "e5f67890123456789abcdef0123456789abcd012",
      "f67890123456789abcdef0123456789abcd01234"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\CometerService",
      "HKCU\\Software\\CometerRAT"
    ],
    "file_paths": [
      "%AppData%\\Cometer\\cometer.exe",
      "%Temp%\\cometer_hook.dll",
      "%ProgramData%\\Cometer\\logs.dat"
    ]
  },
  "defensive_measures": [
    "Monitor outbound network traffic for unencrypted or proprietary encrypted connections on ports commonly associated with RATs (such as 1604)",
    "Enforce endpoint policies blocking unauthorized background access to webcam and microphone hardware",
    "Use behavioral EDR rules to identify unauthorized SetWindowsHookEx calls used for keylogging"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Backdoor:Win32/Cometer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Backdoor:Win32/Cometer"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Backdoor.Win32.Cometer",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [
      "DarkComet RAT Framework"
    ],
    "variants": [
      "Backdoor:Win32/Cometer.A",
      "Backdoor:Win32/Cometer.B"
    ]
  },
  "motivation": "Espionage, Host Surveillance & Unauthorized Remote Control",
  "sample_hashes": []
}