+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Random Users Showing Up on Dark Comet RAT (/showthread.php?tid=5083305)
Random Users Showing Up on Dark Comet RAT - trenz0r - Dec 5, 2015
I created an RAT using Dark Comet. I used no-ip and port forwarding also when setting it up. I did not send the RAT to anyone but myself, however, I saw two random people suddenly appear as slaves. How could this be? I did not send this to anyone?
* - SIM-2059193 - Dec 5, 2015
These are more than likely either
A) Honeypots
B) Antivirus tech's scanning your software
Either way, uninstall them and dont worry about it.
* - SIM-2908357 - Dec 5, 2015
(Dec 5, 2015 09:19 PM)Jordan Bel℉ort Wrote: These are more than likely either
A) Honeypots
B) Antivirus tech's scanning your software
Either way, uninstall them and dont worry about it.
You've pretty much covered it spot on.
Just uninstall them as soon as possible, and never use the scanning/uploading website that you used ever again.
* - SIM-2059193 - Dec 5, 2015
(Dec 5, 2015 09:21 PM)Akzius Wrote: You've pretty much covered it spot on.
Just uninstall them as soon as possible, and never use the scanning/uploading website that you used ever again.
know it from experience :( they're nasty.
I dont think much heat comes from it though op, they might be just looking to get the encryption methods of your file if encrypted, but still uninstall.
The telling signs of these honeypots will likely be an old windows version ( windows xp) and when you open remote desktop it will show weird programs or a banking screen ( see if you are keylogginG)
* - trenz0r - Dec 5, 2015
So when you say honeypot, you mean that they are 'RAT'ing me back? Two Random users connected to me. Also I have Kaspersky on my PC should I just run a full scan for that and will I be good? Or is this now a problem that is very hard to fix??
* - SIM-2908357 - Dec 5, 2015
(Dec 5, 2015 09:32 PM)roiaej Wrote: So when you say honeypot, you mean that they are 'RAT'ing me back? Two Random users connected to me. Also I have Kaspersky on my PC should I just run a full scan for that and will I be good? Or is this now a problem that is very hard to fix??
They are not ratting you back, you have nothing serious to worry about.
All that can be said, is that if you used a crypter, it might not be FUD anymore.
Also, don't use that website that you use to upload/scan again.
* - trenz0r - Dec 5, 2015
Thanks! But what do you mean by website I used to upload/scan? I did not upload anything. Did you mean the crypter I used?
* - LilHackers - Dec 5, 2015
(Dec 5, 2015 09:42 PM)roiaej Wrote: Thanks! But what do you mean by website I used to upload/scan? I did not upload anything. Did you mean the crypter I used?
He means if you scanned the file on VirusTotal or something. Or Uploaded on a site that distributes.
* - Supreme.tm - Dec 5, 2015
Also, dont use no-ip, unless you want to goto jail. You should use FishDNS, its free.
* - #Skyline - Dec 6, 2015
Most like honeypot connections.
* - GOD OF SARADOMIN - Dec 6, 2015
(Dec 5, 2015 09:51 PM)Hatley123 Wrote: Also, dont use no-ip, unless you want to goto jail. You should use FishDNS, its free.
yeah thats right use FishDNS for more SAFE
* - iawaska - Dec 7, 2015
Most others have gone over this but to add on, look into a new FUD crypter.