+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: Cerberus RAT Drops Victims (/showthread.php?tid=2266261)
Cerberus RAT Drops Victims - v0ise - Mar 2, 2012
So I have my test computer infected with my Cerberus RAT (NOT crypted). The computer has A/V active but I made an exception to the location of where the RAT is installed--essentially the entire \Windows directory. It works at first but after around 10 hours the victim no longer shows up on my list. The computer does go through a number of sleep, wake-up cycles but it eventually drops connection to my victim. Any ideas why? Could it be because of how it's not crypted? I've configured the RAT correctly so I don't think it's an issue with that. I have the correct ports forwarded on my end too so nothing wrong there. If I go to my test computer, kill the process, and wait for the process to come back via persistence it shows up on my computer. I don't want my actual victims in the future to drop connections so I want to figure this out!! Please help!!
Oh and also, when I go to my test computer the process for my RAT is still running but I still don't see the computer on my list. Why is that happening?! Is Cerberus known to do that?
* - tux1 - Mar 2, 2012
All rats/keyloggers will lose bots you just have to accept it. If your server isn't crypted then it will get detected by AV much more.
* - v0ise - Mar 2, 2012
Any suggestions as to which RAT lose the least amount of bots?
* - tux1 - Mar 2, 2012
I think darkcomet is pretty stable but if you want to pay for one I think blackshades is good too.