A remote access tool (a RAT) is a piece of software that allows a remote "operator" to
control a system as if he has physical access to that system. While desktop
sharing and remote administration have many legal uses, "RAT" software is usually
associated with criminal or malicious activity. Malicious RAT software is typically installed
without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its
operation from the victim and from security software.
Basically RAT is a tool which allows unauthorized Remote access to someone’s
computer system, and allows us to remotely control the system, modify content and
blow of its Privacy.
Its primary function is for one computer operator to gain access to remote PCs. One
computer will run the "client" software application, while the other computer(s) operate as
the "host(s)".
The RAT Trojans can generally do the following:
Block mouse and keyboard
Change your desktop wallpaper
Download, upload, delete, and rename files
Drop viruses and worms
Edit Registry
Use your internet to perform distributed denial of service attacks (DDoS)
Format drives
Grab passwords, credit card numbers
Hijack homepage
Hide desktop icons, taskbar and files
Log keystrokes, keystroke capture software
Open CD-ROM tray
Print text
Play sounds
Control mouse or keyboard
Record sound with a connected microphone
Record video with a connected webcam
Shutdown, restart, log-off, shutdown monitor
Steal passwords
View screen
View, kill, and start tasks in task manager
A well designed RAT will allow the operator the ability to do anything that they could do
with physical access to the machine.
The different types of RAT Software’s are:
DarkComet RAT
Blackshades RAT
Xtreme RAT
Cybergate RAT
Sub Seven
Pain RAT
JRAT
Net Devil
Apocalypse RAT
Shark RAT
Back Orifice
Bandook RAT
Bifrost
LANfiltrator
Optix Pro
ProRat
Step 1 – Setting Up Your DNS
Questions to ponder:
Slaves or victims are connected to as long as we are online, but what will happen if we
accidently or purposely go offline?
Will they connect to us again when we are online again?
The answer to all this is, that the victims catches will disappear if the connection between
them and us is disturbed or terminated ev en for once, So in order to keep the connection
between them and us alive we use a Domain service which will act as a temporary host in
place of us, So that When we are offline it will take our place and make the connection
alive and we are back, Then to give back the session to us.
So for all this you need to register on to an active Domain/ Website
So you’ll need a DNS so that the slaves have a connection to connect back to you.
You’ll need to go to No-ip.com.
It is a free Domain registering website that allows us to register a domain, so as to link it
to our account.
After you go to no-ip you’ll need to register an account, after you do this you should be
able to login.
After you see this page click on "Add a Host".
This is going to be your host name, this can be any name, and there are some sample
hosts names given you have to choose from it. For the hostname input any name you
want.
Congrats you now have a DNS for your RAT
Then you’ll scroll down and click on "add Host"
Now that we have created a Domain, we need some intermedium connectivity with the
domain, so we use special software which acts as an interface between our machine and
the domain registered.
In this case, we are going to use the software by the name DUC Client.
This client is available free on the same website, just go on and download the client.
Go to Download options and download the software
Now install this DUC (Dynamic Update Client) T ool and Login via noip details.
The details will be the same that you have filled in the domain registration time.
After Successfully Login, Please click on Select Hosts and Select your all hosts
After selecting your hosts, click on Refresh Now button.
Step 2 – Port Forwarding
Port forwarding is the process that your router or firewall uses to sort the right kind of
network data to the right port. Computers and routers use ports as a way to organize
network data. Different types of data, such as web sites, file downloads, and online games,
are each assigned a port number.
Basically Port forwarding is a process of assigning a dedicated logical port to our newly
made virus. By using port forwarding, the router or firewall sends the correct data to the
correct place.
PORT FORWADING WAY 1:
Now to open or forward the port, you need to go to router setting page, now First of all
you need to know your ip address it may or may not be asked by the router . To check your
ip open your command prompt (cmd) through RUN Command and type “ipconfig”
Note Down your IPv4 Address and Default Gateway and Open your Default Gateway
address in your browser by typing this link http://192.168.1.1/
On the router setting page, follow these steps to locate the appropriate setting column.
Generally the port address field is found in NAT settings Virtual Servers or in
Firewall settings
The entries made should be of both TCP and UDP protocol, make sure the settings are
saved before exiting
WAY 2: You can also Open/ Port Forward your port by adding the entry into your Torrent
client.
Torrent clients like: Bit Comet, Bit torrent, U Torrent etc. All you have to do is, initialize any
torrent client and start downloading any torrent file, after it begins downloading open the
properties if the torrent file, there you will notice a port number generally having the value
in thousands, you can change that value to the value of port number you want and click on
update/ save, and so the torrent client will activate that specific port for the downloading of
the requisite torrent file.
TO CHECK IF PORT IS OPEN/IN FORWARD MODE OR NOT:
To check if the port is in open /forward mode or not, we first add the entry into our Dark
Comet client,
That is, we simulate our Remote access tool to start listening for activities on the specific
ports.
This can be done by , opening your DARK COMET Client, from the tabs given click on
Socket/Net, from there in the list right click and click on add port/listen to new port
and enter your port number, or if there are more than one port repeat the process and add
all your port number step by step.
Now that the client is in listening mode, open your web browser and open the URL,
“canyouseeme.org”. Here enter your port no which you want to confirm is open or not.
If it is a success, then it will look like this
Step 3 – Make a Payload Virus/Trojan
Open your Dark Comet client , click on DARK COMET RAT Server Module Full
Editor (Expert mode).
S1) First of all in the Main setting window, in the process mutex column click 2-3 times
on Random to generate a random algorithm.
Then in Server ID column you can give a nameif not then leave it as it is, then in Profile
name , you can give a profile name for the setings we wil use, so that in future you don’t
have to again tune all settings, just load the previous profile.
You can also use the active FWb option to bypass the firewall security , so that it can easly
run with firewall on in victims system.
S2) Now in the next step i.e. in Network setting window, in IP/DNS column enter your
domain name which was created on your no-ip account, and in Port column add the
unique port number which you have set in port forward mode
S3) that is Module startup, here are many a great options to use, first option is to start
the stub in windows , that is to start your virus file as a windows operating file, you can
here define the name of the process by which it will run , and will be shown in the process
manager.
Also on to the next option you can choose to melt the file, that is after the very first
execution the file will melt itself that is will disappear, but the process will continue to run.
Also you can change the Creation date, along with you can change the Attributes of the
virus, like you can make it hidden, system file, read only file etc.
S4) Moving on to the next option of Install message, here you can create a message
that you want to display , when anybody runs your virus file.
S5) Now the next option is Module shield, here are given variety of options to safeguard
your virus file. You can choose all the options or the option which pleases you the most
S6) Next option is of key logger , use it if you have a active FTP account, fill the columns
and enjoy every keystroke pressed b y the victim onto his/her system
S7) The next to next options are generally of no big use, so we skip them, coming to next
option of File binder, here you can bind your virus file onto some existing file, so that
your virus is not visible, as it will be masked onto some existing file, after choosing the file ,
click on add file/bind file to generate a newly binded file
S8) Next is to choose an Icon for the file,
S9) Last option is Stub finalization; here you can choose to compress your virus.
When done, click on generate/Build the stub, provide a specific path for the file to generate,
after that your file will be saved for distributing to others.
Here is a list of the victims catched by this activity.
control a system as if he has physical access to that system. While desktop
sharing and remote administration have many legal uses, "RAT" software is usually
associated with criminal or malicious activity. Malicious RAT software is typically installed
without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its
operation from the victim and from security software.
Basically RAT is a tool which allows unauthorized Remote access to someone’s
computer system, and allows us to remotely control the system, modify content and
blow of its Privacy.
Its primary function is for one computer operator to gain access to remote PCs. One
computer will run the "client" software application, while the other computer(s) operate as
the "host(s)".
The RAT Trojans can generally do the following:
Block mouse and keyboard
Change your desktop wallpaper
Download, upload, delete, and rename files
Drop viruses and worms
Edit Registry
Use your internet to perform distributed denial of service attacks (DDoS)
Format drives
Grab passwords, credit card numbers
Hijack homepage
Hide desktop icons, taskbar and files
Log keystrokes, keystroke capture software
Open CD-ROM tray
Print text
Play sounds
Control mouse or keyboard
Record sound with a connected microphone
Record video with a connected webcam
Shutdown, restart, log-off, shutdown monitor
Steal passwords
View screen
View, kill, and start tasks in task manager
A well designed RAT will allow the operator the ability to do anything that they could do
with physical access to the machine.
The different types of RAT Software’s are:
DarkComet RAT
Blackshades RAT
Xtreme RAT
Cybergate RAT
Sub Seven
Pain RAT
JRAT
Net Devil
Apocalypse RAT
Shark RAT
Back Orifice
Bandook RAT
Bifrost
LANfiltrator
Optix Pro
ProRat
Step 1 – Setting Up Your DNS
Questions to ponder:
Slaves or victims are connected to as long as we are online, but what will happen if we
accidently or purposely go offline?
Will they connect to us again when we are online again?
The answer to all this is, that the victims catches will disappear if the connection between
them and us is disturbed or terminated ev en for once, So in order to keep the connection
between them and us alive we use a Domain service which will act as a temporary host in
place of us, So that When we are offline it will take our place and make the connection
alive and we are back, Then to give back the session to us.
So for all this you need to register on to an active Domain/ Website
So you’ll need a DNS so that the slaves have a connection to connect back to you.
You’ll need to go to No-ip.com.
It is a free Domain registering website that allows us to register a domain, so as to link it
to our account.
After you go to no-ip you’ll need to register an account, after you do this you should be
able to login.
After you see this page click on "Add a Host".
This is going to be your host name, this can be any name, and there are some sample
hosts names given you have to choose from it. For the hostname input any name you
want.
Congrats you now have a DNS for your RAT
Then you’ll scroll down and click on "add Host"
domain, so we use special software which acts as an interface between our machine and
the domain registered.
In this case, we are going to use the software by the name DUC Client.
This client is available free on the same website, just go on and download the client.
Go to Download options and download the software
Now install this DUC (Dynamic Update Client) T ool and Login via noip details.
The details will be the same that you have filled in the domain registration time.
After Successfully Login, Please click on Select Hosts and Select your all hosts
After selecting your hosts, click on Refresh Now button.
Step 2 – Port Forwarding
Port forwarding is the process that your router or firewall uses to sort the right kind of
network data to the right port. Computers and routers use ports as a way to organize
network data. Different types of data, such as web sites, file downloads, and online games,
are each assigned a port number.
Basically Port forwarding is a process of assigning a dedicated logical port to our newly
made virus. By using port forwarding, the router or firewall sends the correct data to the
correct place.
PORT FORWADING WAY 1:
Now to open or forward the port, you need to go to router setting page, now First of all
you need to know your ip address it may or may not be asked by the router . To check your
ip open your command prompt (cmd) through RUN Command and type “ipconfig”
address in your browser by typing this link http://192.168.1.1/
On the router setting page, follow these steps to locate the appropriate setting column.
Generally the port address field is found in NAT settings Virtual Servers or in
Firewall settings
The entries made should be of both TCP and UDP protocol, make sure the settings are
saved before exiting
WAY 2: You can also Open/ Port Forward your port by adding the entry into your Torrent
client.
Torrent clients like: Bit Comet, Bit torrent, U Torrent etc. All you have to do is, initialize any
torrent client and start downloading any torrent file, after it begins downloading open the
properties if the torrent file, there you will notice a port number generally having the value
in thousands, you can change that value to the value of port number you want and click on
update/ save, and so the torrent client will activate that specific port for the downloading of
the requisite torrent file.
TO CHECK IF PORT IS OPEN/IN FORWARD MODE OR NOT:
To check if the port is in open /forward mode or not, we first add the entry into our Dark
Comet client,
That is, we simulate our Remote access tool to start listening for activities on the specific
ports.
This can be done by , opening your DARK COMET Client, from the tabs given click on
Socket/Net, from there in the list right click and click on add port/listen to new port
and enter your port number, or if there are more than one port repeat the process and add
all your port number step by step.
Now that the client is in listening mode, open your web browser and open the URL,
“canyouseeme.org”. Here enter your port no which you want to confirm is open or not.
If it is a success, then it will look like this
Step 3 – Make a Payload Virus/Trojan
Open your Dark Comet client , click on DARK COMET RAT Server Module Full
Editor (Expert mode).
on Random to generate a random algorithm.
Then in Server ID column you can give a nameif not then leave it as it is, then in Profile
name , you can give a profile name for the setings we wil use, so that in future you don’t
have to again tune all settings, just load the previous profile.
You can also use the active FWb option to bypass the firewall security , so that it can easly
run with firewall on in victims system.
domain name which was created on your no-ip account, and in Port column add the
unique port number which you have set in port forward mode
S3) that is Module startup, here are many a great options to use, first option is to start
the stub in windows , that is to start your virus file as a windows operating file, you can
here define the name of the process by which it will run , and will be shown in the process
manager.
Also on to the next option you can choose to melt the file, that is after the very first
execution the file will melt itself that is will disappear, but the process will continue to run.
Also you can change the Creation date, along with you can change the Attributes of the
virus, like you can make it hidden, system file, read only file etc.
S4) Moving on to the next option of Install message, here you can create a message
that you want to display , when anybody runs your virus file.
S5) Now the next option is Module shield, here are given variety of options to safeguard
your virus file. You can choose all the options or the option which pleases you the most
S6) Next option is of key logger , use it if you have a active FTP account, fill the columns
and enjoy every keystroke pressed b y the victim onto his/her system
S7) The next to next options are generally of no big use, so we skip them, coming to next
option of File binder, here you can bind your virus file onto some existing file, so that
your virus is not visible, as it will be masked onto some existing file, after choosing the file ,
click on add file/bind file to generate a newly binded file
S8) Next is to choose an Icon for the file,
S9) Last option is Stub finalization; here you can choose to compress your virus.
When done, click on generate/Build the stub, provide a specific path for the file to generate,
after that your file will be saved for distributing to others.
Here is a list of the victims catched by this activity.
.png)