+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Botnets and Botting (https://hackforums.net/forumdisplay.php?fid=92)
+---- Thread: What's your Preference... Botnets , loaders and RATs (/showthread.php?tid=6330342)
Pages: Pages
1
2
RE: What hooked you - CyberXero - Sep 6, 2026
(Sep 6, 2026 07:46 PM)WraithTools Wrote: The trick is to keep it native no .NET etc, Small stub, decent crypter that just crypts no fancy features. Bulletproof domains and hosting.
honestly probably the best advice I have heard despite being brief still valuable!
(Sep 6, 2026 07:52 PM)Terry A. Davis Wrote: I didn't create a malicious one, but I have created a closed net of discrete computers that are able to complete tasks I assign based on computers around the country.
I have field PCs, and have basically made a tool that says you are to do this bit of discrete work. Whatever that may be, if it is tangible I can have it done.
that actually sounds pretty cool, i could imagine a few projects that require such networking, most people use websites to share the workload but doing this through botnet sounds really discreet, sounds like... feds typa stuff 🤭🙃😁😋
RE: What hooked you - WraithTools - Sep 7, 2026
(Sep 6, 2026 09:32 PM)CyberXero Wrote: honestly probably the best advice I have heard despite being brief still valuable!
that actually sounds pretty cool, i could imagine a few projects that require such networking, most people use websites to share the workload but doing this through botnet sounds really discreet, sounds like... feds typa stuff 🤭🙃😁😋
It really varies on what you are planning to do with it but always take a modular loader to spread with over something like a RAT with 10,000 features. You want your loader to survive on the system as discreetly as possible, any other features can always be loaded by external tools. With hybrid p2p you don't even need heavy servers or round robin setups anymore as each bot shares the workload.
RE: What Influenced you to create a Botnet! - XtremeDiscount - Sep 10, 2026
Back when I was younger and had one it was just for fun lol
RE: What Influenced you to create a Botnet! - CyberXero - Sep 10, 2026
(Sep 10, 2026 03:54 PM)XtremeDiscount Wrote: Back when I was younger and had one it was just for fun lol
You still run a botnet/rat these days?
RE: What Influenced you to create a Botnet! - XtremeDiscount - Sep 10, 2026
(Sep 10, 2026 05:41 PM)CyberXero Wrote: You still run a botnet/rat these days?
Not anymore
RE: What Influenced you to create a Botnet! - i_r_blitzer - Sep 17, 2026
I just randomly googled this website to check if it's still alive and to my surprise it's still running. Damn I miss the good old days. It's so nostalgic for me just to be here and make a post talking about botnets etc. I was never a programmer/hacker etc but I have always been around the scene/community from the early days and was always fortunate enough to have the right people who liked me and always helped me do anything I needed. I miss the times of mIRC and all the cool people who were around and willing to help you for free without wanting anything in return, but the world and humans have changed a lot since those days because now everything is about money. I can vividly remember the first time I had my first botnet, it was so exciting experimenting with the features, finding ways to make my .EXE files FUD, infecting more machines etc etc. I could talk about this for days but i don't want to bore you all :) it's really hard to understand unless if you were around in those days yourself. I hope all those people are doing well in life today <3
RE: What Influenced you to create a Botnet! - keranoe - Sep 17, 2026
I miss IRC the most (PMA my love <3), I think that was the most fun I had when looking to start off. I miss those kind of clients that had the "retro" vibe I guess. 2016 was the big IoT which got me more into the programming and not just ripping existing software. Then with help from people long gone to the internet, shifting into windows malware and the evolution for years until recently p2p. Interplanetary Storm was one that got me looking into it and how it's been utilized both in the past and now :)
I would throw it all away for the old days of the internet
RE: What Influenced you to create a Botnet! - CyberXero - Sep 18, 2026
The golden age was great!
RE: What's your Preference... Botnets , loaders and RATs - hoangthang - Sep 22, 2026
ok verigood [warn]
RE: What's your Preference... Botnets , loaders and RATs - CyberXero - Sep 22, 2026
(Sep 22, 2026 12:50 PM)hoangthang Wrote: ok verigood
Please refrain from spamming please and read the Help Docs
RE: What hooked you - roker8866 - Sep 26, 2026
(Sep 7, 2026 12:29 AM)WraithTools Wrote: It really varies on what you are planning to do with it but always take a modular loader to spread with over something like a RAT with 10,000 features. You want your loader to survive on the system as discreetly as possible, any other features can always be loaded by external tools. With hybrid p2p you don't even need heavy servers or round robin setups anymore as each bot shares the workload.
I understand you are conveying three key points here:
1. Modular Loader vs. Bloated RAT
- RAT files often pack too many features (screen recording, cryptomining, password theft, audio recording, etc.), resulting in large file sizes and numerous identifiable signatures that are easily detected by antivirus or EDR software.
-> In contrast, a Modular Loader focuses on a single task: stealthy infiltration and establishing an initial foothold. Its minimalist codebase allows it to easily bypass initial security checks.
2. Maintaining Stealth & On-Demand Dynamic Module Loading
- Once the Loader establishes a secure connection, the attacker deploys functional modules (plugins) and executes them directly in RAM (In-Memory Execution).
-> This technique segregates risk: if a specific module is detected and blocked, the main Loader process remains active in the background, allowing the attacker to load other tools later.
3. Hybrid P2P Botnet Architecture
- Traditional C2 Infrastructure: Relies on central servers or IP rotation techniques (Round-Robin/Fast-Flux DNS). A major weakness is that if security agencies take down the C2 server, the entire botnet is neutralized.
-> Hybrid P2P Model: Infected machines (bots) share the task of relaying commands among themselves. Each infected device acts as both a victim and a relay node. This results in a decentralized infrastructure with no "single point of failure," making it extremely complex to trace and dismantle the entire network.
==
Please let me know if I have misunderstood anything! Thanks
RE: What hooked you - WraithTools - Sep 26, 2026
(Sep 26, 2026 08:58 PM)roker8866 Wrote: I understand you are conveying three key points here:
1. Modular Loader vs. Bloated RAT
- RAT files often pack too many features (screen recording, cryptomining, password theft, audio recording, etc.), resulting in large file sizes and numerous identifiable signatures that are easily detected by antivirus or EDR software.
-> In contrast, a Modular Loader focuses on a single task: stealthy infiltration and establishing an initial foothold. Its minimalist codebase allows it to easily bypass initial security checks.
2. Maintaining Stealth & On-Demand Dynamic Module Loading
- Once the Loader establishes a secure connection, the attacker deploys functional modules (plugins) and executes them directly in RAM (In-Memory Execution).
-> This technique segregates risk: if a specific module is detected and blocked, the main Loader process remains active in the background, allowing the attacker to load other tools later.
3. Hybrid P2P Botnet Architecture
- Traditional C2 Infrastructure: Relies on central servers or IP rotation techniques (Round-Robin/Fast-Flux DNS). A major weakness is that if security agencies take down the C2 server, the entire botnet is neutralized.
-> Hybrid P2P Model: Infected machines (bots) share the task of relaying commands among themselves. Each infected device acts as both a victim and a relay node. This results in a decentralized infrastructure with no "single point of failure," making it extremely complex to trace and dismantle the entire network.
==
Please let me know if I have misunderstood anything! Thanks
Why have you replied to me with Ai slop?