+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: weird incident (/showthread.php?tid=4946412)
weird incident - EbonCipher - Aug 12, 2015
So i tried my rat on my cousin and all of sudden 2 people from the US appeared? I couldn't do anything, but they were just there, and after 1-2 mins they disappear again?. What the actual fuck?. lmao.
* - IHasBrains - Aug 12, 2015
Maybe honeypots. If you can, uninstall them. Leave them alone if you can't.
* - Bad C0d3 - Aug 12, 2015
Maybe some online sandbox service
* - Yetiii - Aug 12, 2015
Previous clients/Slaves? Maybe the RAT you are using is unstable
* - Leeway - Aug 12, 2015
I am guessing they are honey pots I would also suggest uninstalling them.
* - Esme - Aug 12, 2015
I'd say just uninstall them. Where have you been scanning?
* - ze-slade - Aug 12, 2015
Have you only spread your rat to your cousin?
* - kəˈrɪzmə - Aug 12, 2015
Why would you want to RAT family lol?
What DNS are u using?
Check out my sig for a good spreading method
* - EbonCipher - Aug 12, 2015
(Aug 12, 2015 01:54 PM)Xaos™ Wrote: Why would you want to RAT family lol?
What DNS are u using?
Check out my sig for a good spreading method
testing it on my cousin. I asked for permission before i did anything.
using duckdns
* - Armada - Aug 12, 2015
Firstly stay away from Duck DNS.
They are Known to Honey Pot our Binaries now. SEE THIS THREAD FOR INFO
But in relation to your question, if both of the clients appeared identical some rats are known to Double log clients in to the console, one of them could have simply been a shadow\ghost connection to the original.
Otherwise it is likely DuckDNS's Honeypot analyzing your binary and reporting it to AV vendors.🤝
* - Strayta - Aug 12, 2015
Don't use duckdns man. That is probably why you got 2 more
* - EbonCipher - Aug 12, 2015
(Aug 12, 2015 02:12 PM)Gargle Cum Wrote: Don't use duckdns man. That is probably why you got 2 more
Which one do you prefer?.