Ultimate Guide to Setup DarkComet RAT

with NoIP

What is Darkcomet?
DarkComet RAT is a free and popular Remote Administration Tool. This software is
an efficient type of software, especially created to remote control any Microsoft
Windows machine.

It is famous for being one of if not the most stable and most complete RAT’s
available. Just like VNC and other similar types of software, DarkComet gives you
the ability to connect to and control your systems, wherever you are.

You can keep a close eye on your computers to supervise the online activity of your
employees or children. Furthermore DatkComer RAT can be used to monitor your
system, remotely assist your clients or family members to recover lost data or repair a
computer.

The main functions of DarkComet RAT are System Monitor (Process, Registry,
Startup, DNS Manager, etc.), File manager (which is even more complete than an
FTP-server), Surveillance (Micro-capture, Keylogger, Screen capture, Webcam
capture, etc.), Network functions (Scan for local computers, monitor network activity,
WIFI viewer, download files from web, etc.) and much more.

Both the DarkComet RAT Controller and its Controlled module can be detected by
some antivirus-programs but that constitutes a false positive due of the abilities of the
program in the system. The package doesn’t and will not ever contain any viruses or
other types of malware. Its why DarkComet RAT got such a very good reputation.

HackingSpace.org
Requirement before Setup
1. Latest Darkcomet RAT Legacy v5.4.1. Link to download will be provided at the
end of this post.
2. A No-IP account (Click to visit site)

What is No-IP?

No-ip is a DNS redirectional service. You may have used it before if you managed a
RSPS. For RSPS, it was easier than remembering a specific IP like 83.111.911.83 for
an example. Rather RSPSserver.zapto.org or something. For your RAT, it simply
covers your ass if your IP changes. The problem with direct linking to your IP is if
your IP changes and you’re NOT using No-ip, you lose every single one of your
slaves. This is where No-ip comes to rescue, making sure that as long as you used it,
slaves are redirected to your real IP and you keep all of your slaves. It’s why it’s so
crucial.

HackingSpace.org
How to create and setup No-IP account?

Go to http://www.no-ip.com/ and hover over “Sign in” and click “Sign up for an
account”.

HackingSpace.org
Now go to your email and click on the confirmation link.

Go Download the client app from this link or on their website.

Install it in your OS. After the installation you will see this windows popup. Type in
your username and password.

HackingSpace.org
After you’ve successfully login, you should see something like this.

Do not freak out, click on EDIT HOSTS. Login to your noip.com type in your
username and password and click on Manage Host

HackingSpace.org
Now back to your DUC or NoIp app. Click on Edit Host

HackingSpace.org
Check on the host that you’ve just created and click on Save.

If you’ve done it correctly, you should see something like this.

That’s it. All that you need to do with it after is keep it running, and it will perform its
duty of redirecting your slaves to your real IP. Enjoy.

HackingSpace.org
How to Set up Darkcomet?
This is where I see a lot of things go wrong, this is where the false information gets
spread, propagated, and A LOT of things can go wrong. Let’s begin. Start by
extracting and opening Darkcomet. If you recently downloaded it from the link I
mentioned earlier, you have to extract it from the .ZIP before you can use it.

What the @#$% happened to Darkcomet?!

If your Darkcomet.exe does not have a blue asteroid icon, or just doesn’t show at all,
your Antivirus has likely quarantined and/or corrupted Darkcomet. Turn it off. If you
don’t have an AV and it still does this, Windows Defender is likely the cause.

How to disable windows defender?

Click the Start Button -> (Enter into the Search Box) -> Windows Defender -
> Open -> Tools -> Options -> Administrator -> Use this program? -> Uncheck -
> Apply -> You’re awesome! Once Darkcomet is open, an EULA should come up,
just hit the checkbox, “Do not again display the EULA” and press Accept after 10
seconds. After Darkcomet is open (and it is your first time), another box should come
up giving you general tips about Darkcomet. If you wish to read through it, that’s fine.
Just hit “Do not show on restart” and then “Fine” after you are done.

Once it is open, go to the Socket/net Tab at the top middle-right and right click in the
general area, and click “Add port to listen.”

HackingSpace.org
 This box should come up.

What should I put for the port?

The port, like the No-ip, does not matter. The only two restrictions are it HAS to be a
number between 1-65535 and another program must not be using it. Other than that,
go free. 1337 or 1604 or 101 are all popular, it’s really your own preference, though.
Once you click Listen, a Windows Firewall diologue box should pop up (If you have
it enabled) and if it does, just click “Allow access”. This is Darkcomet trying to add
itself as an exception to the firewall, this is fine.

What is upnp.exe in %temp% for?

Darkcodersc (Coder of Darkcomet) added Universal Plug and Play to Darkcomet.
This is not a RAT or a keylogger, it is simply trying to portforward for you
automatically. I’d say this is a good thing, especially since most routers support it and
it would eliminate the hassle for you trying to portforward. Once it is added, navigate
to Canyouseeme.org and check if it’s open. If UpNP worked successfully, your port
should be open and working.

HackingSpace.org
Hurray! Good for you. If it’s not, do the following.

1. Completely Disable Windows Firewall/Any other Firewalls you may have. (These
often block the ping from canyouseeme.org)
2. Completely disable your antivirus (Some block the connection as well.)
3. Make sure Darkcomet is open AND listening to the port. (I cannot stress this
enough, it will be a false negative, your port MUST be listened to before it can
show as open.)
If it still not open, I will have a mini tutorial soon for portforwarding near the bottom
of the post. Alright. My port is open, Darkcomet is open, what do I do now? Make a
stub.

HackingSpace.org
There are two different options for making a stub: Minimalist and Expert. I will sum
up the options here:
§ Minimalist: Little options, very hard to screw up but still possible.
§ Expert: A plethora of options, any screw up will leave you with a corrupted server
after crypting.
§

Settings for Minimalist:

Stub ID is a variable which can set to your liking, though it could be used for
organization of your slaves. IE: From Youtube, From Ewhoring, From Torrents, From
X Crypter, etc. IP/DNS: No-ip address. Port: The port you chose earlier in the thread.
1604 is the default port. Generate the stub as “Normal”. Why? It has a chance to
corrupt if you crypt a small server. (As it’s compressed with UPX)

Why did you turn off startup?

It ensures the maximum amount of compatibility for your crypter. It is much more
stable to use your crypter startup. In my own experiences, it has also corrupted the
stub after it was crypted, though not all the time. It’s essential to leave it off for this

HackingSpace.org
reason. Settings for Expert: Expert only has one advantage in my opinion to
Minimalist, otherwise it’s the exact same. Mutex. Mutex ensures that only one copy of
that specific stub runs on one slave. It is useful for making sure that your slave count
is accurate, and to avoid duplicates.

For Advanced Users

(Note that the Client Password is not required, if you don’t want to use it, that’s fine.
Just uncheck it, but I will be covering it as it does increase security for you by a good
amount.) Click “Network Settings,” the settings for such can be found here:

HackingSpace.org
(Once again, 1604 was the default port for Darkcomet. Obviously replace it with the
one you are using.) Skip “Module Startup”, “Install Message”, and “Module
Shield”, “Keylogger”, “Hosts File”, “Add Plugins”, “File Binder”, “Choose
Icon”, skip down to “Stub Finalization”.

Why??

This is to ensure the maximum amount of compatability for the crypter you are using.
If you want any options on any of those pages, it should be enabled on your crypter
only. (Especially startup.) Now, make sure to build it according to my settings
following:

HackingSpace.org
Click Build the stub, give a name to it and hit enter. Congrats, you are ready to test
your stub. What about the password we set earlier? Oh right, let’s cover that!
Navigate to Client Settings.

Enter the password you entered earlier in Expert build (If you used it. If you did not,
do not bother with this step.)

HackingSpace.org
Now, we are ready to test it.

Still doesn’t work no matter what I do

This is due to your router not supporting NAT Loopback, most do not. Therefore, you
testing it on yourself will give you a false negative in terms of whether or not your
server works.

How do I test my stub, then?

Use Anubis. (Uncrypted servers ONLY, Anubis distributes samples + Crypted ones
do not work.) You may also be able to test it if some very helpful person were to give
you a test install, otherwise running it on one of their slaves to see if your server
works. (I do not do this as I have little slaves.)

HackingSpace.org
Mini Portforwarding Tutorial

I understand that most routers do not have the exact same options, but the majority of
them support port forwarding in the exact same way. It may be called as a different
name, “Virtual Server” or “Port Opening” or “Pin holes” or just “Port Forwarding”.

These are the exact same thing. Navigate to the start Menu -> Enter into search
box -> Cmd -> Hit Enter.
When that black box comes up, type “Ipconfig” and hit Enter. The following text
should come up.

Find the “Ipv4 address” and copy it down. This is the IP you’ll be forwarding too.

There are multiple Ipv4 addresses, which one do I know is right?

There is two ways. It is the first one to display this information (It’s not at the bottom,
it’s at the very top after you type the command.)

The second way is if it has “default gateway”. This is a surefire way to tell that it is
correct.

HackingSpace.org
Copy the “Default Gateway” into the address bar of your browser. Then hit enter. If
your router has a password, it should prompt you for a password.A quick google
search of your router model + default password will probably reveal it.

That’s on you. Once you’re at your router page, it can be tricky to locate the “Port
forwarding” option. It is, in most cases, located under the Security
section/Firewall/Advanced Settings/Advanced Setup.
It’s different for every router, so there is no way to encompass them all. Mine was
under Advanced Setup.

Yours should look similar to mine (but not in GUI, but in options.)

HackingSpace.org
Starting Port: The port you’re going to use on your RAT.
Ending port: The port you’re going to use on your RAT. (Note that Starting port and
Ending port should be the same number. As it only requires one port to RAT for
Darkcomet.)
Protocol: TCP (It’s what Darkcomet uses.)

If your router only has “Both” and you want to be doubly sure, go ahead.
It doesn’t matter, as long as it encompasses TCP at one point or another. IP address:
That IPv4 address from CMD, enter that in that box. Since the other settings are
marked as optional by my router, the only thing you need to do now is hit the
equivalent of “Apply” on your router.

It may be save settings, it may be apply settings, whatever. Your router may restart to
apply them, and it may not. It depends on what you have.

Darkcomet is open (and listening to the port). Windows Firewall is off. Antivirus
is off. I followed the mini portforwarding guide. My port is still not open. What
do?
In this, there is only one more option on your router that could be of assistance. In my
case DynDNS: (Dynamic DNS) This will allow ANY traffic from any port on your

HackingSpace.org
router. This is a major security concern. If you wish to allow it, find “Dynamic DNS”
on your router, enable it and enter your IPv4 address and hit Apply.

That’s All! I hope you enjoyed the tutorial. If I did ANYTHING wrong at all, I gave
the false info, I had a spelling mistake, my image was not relevant. PLEASE leave the
comment or shoot me an email. I really love to hear your feedback on this post.

Download Links:
Darkcomet v5.4.1 Legacy
Mirror Links:
Mirror Link 1
Mirror Link 2
Mirror Link 3
 

HackingSpace.org