+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: [UPD: 05/19] [Massive] A Comprehensive Remote Administration Guide (/showthread.php?tid=5327327)
[UPD: 05/19] [Massive] A Comprehensive Remote Administration Guide - Purple Kief - Jul 4, 2016
What I ask of you
Spoiler (Click to View)
I believe my guide is finished but there is still room for improvement.
I might have missed something or posted some wrong information. (very unlikely)
Please leave your suggestions as comments below so I can possibly add them.
Aside from that, I spent A LOT of time on this guide. I kindly ask that you spread it around to people that want to learn about RAT's.
99% of the time this will hold more for them than your 1 - 5 line comment.
Thank you:
- Eternal: for giving me a 1 month code to use for the tutorial. (143VPN)
- French crypter: for giving me a 10 days code to use for the tutorial. (Static Crypt)
- Cibor: for giving me a 1 day code to use for the tutorial. (Ozone)
- ShockWave: for giving me a lifetime code to use. (Imminent Monitor 4.3)
- no$fera$tu: for giving me a 24h code to use for the tutorial. (Data Protector V4)
- Revcode: For the 72h trial account on your site. (Revcode Webmonitor)
Introduction + Goal
Spoiler (Click to View)
Hello HF community, thanks for making it over to my thread. Are you tired of the same questions being explained over and over again? 10 billion links that you can find all over the place that lead to all over the place?
No more. I'm writing everything that's within my knowledge down in this massive thread. The goal here is to have 1 massive RAT hub that people can come to to find anything, let's see if we succeed.
I encourage you to leave anything I missed/suggestions in the comment since I plan on updating this A LOT!
Index
Spoiler (Click to View)
Since it's hard to have an index in a page filled with spoilers I'll have a color index.
This'll help you navigate at least a tiny bit.
-- General --
-- Port Forwarding Related --
-- Crypting related --
Things you NEED to know about a RAT
Spoiler (Click to View)
- a RAT is legal software and is not meant to be used in any malicious way. If you do use it in a malicious way you are at constant risk of losing your license and going to jail.
- Your clients will not dissapear after you or them have restarted their computer. (providing you used startup which I explain later on in the guide)
- Most RATs are HWID locked meaning you can only use 1 computer per license. Don't try and share it with your friends. Orcus is an exception and allows 3 per license.
- You can have user or administrator permissions on your clients, changing the amount of things you can do drastically.
- Unless you are using a PHP RAT you will ALWAYS require port forwarding.
- Certain RATs have dependencies while others don't. Explained more in-depth later on.
Things you NEED to know about using a crypter
Spoiler (Click to View)
- A crypter is legal software and is not meant to crypt malware with. Doing this you always run the possibility of your license being banned.
- Crypters are not magic, it's not as simple as drop in a .exe and have it come out FUD.
- If you are getting 8+/35 detections don't go crying to the owner. They can be fixed by you if you follow the guide later on.
- Ticking every single option in your crypter is a good way to corrupt your RAT beyond using.
- There's a difference between scantime and runtime. Scantime is the result of your file being scanned without it being executed on a PC. Runtime is the result of it being scanned while it's running on your clients PC. (Making it much easier to detect and making scantime useless)
- Don't EVER double up on settings in both your RAT and crypter. Nothing good comes from that.
- THE CHEAPER THE CRYPTER THE BETTER THE QUALITY IS NOT THE RIGHT ATTITUDE.
Port forwarding
Spoiler (Click to View)
Port forwarding, most of you guys usually go DEAR GOD HELP ME when you are confronted with this. WELL NO MORE! After this guide everyone should be able to port forward with or without VPN. Why do you need to port forward? You need an open port for outside connections (your client) to connect to your internet. Well, let's get into the without VPN part first.
Understand the following BEFORE going onto this guide.
- Googling your router and how to port forward on it will NEVER hurt. They give information that is impossible for me to know in advance such as what you need to click on etc.
- There's a couple different router setups. I'm going to cover the ones I know which is a total of 3 ways. It's up to you to figure out which one of these is closes to yours.
- Even when you THINK your port forwarding is done, keep on reading and don't miss a SINGLE step!
Possible setup no. 1 - Regular portforwarding
This is the easiest to do and also the most common among routers.
Go over to your router page found by typing in your default gateway into your browser.
How do you find your default gateway? Open your cmd.exe and type in ipconfig which will show you your default gateway 2 lines below your IPv4.
In the picture below my default gateway is 192.168.0.1.
![[Image: SVnxHod.png]](https://i.imgur.com/SVnxHod.png)
Now that you are on your router page you will want to find the port forwarding tab.
Usually this can be found under the advanced tab and is straight up called 'port forwarding'.
Once you've found it, click on it and you should see something similar to this.
![[Image: DCNrhRm.png]](https://i.imgur.com/DCNrhRm.png)
Now don't get scared by the different language shown here. Let me quickly explain in order what those words mean. What you're looking at is Internal IP-adress / Begin port / End port / Protocol / Activated.
Your internal IP adress is your IPv4 shown above your default gateway. Your begin port and end port should be the same and is the port you are trying to open. Protocol is either UDP or TCP or BOTH. You will want to choose BOTH!
Now that you know all this, this is what it should look like filled in. (In this picture I have opened port 30000)
![[Image: NsZwh1H.png]](https://i.imgur.com/NsZwh1H.png)
When you filled in yours and it looks like mine (with your IPv4 and desired port) hit save changes and that concludes port forwarding. Read the 'testing your port' category on how to PROPERLY test your port. DON'T TEST IT ON YOUR OWN, GO READ THAT SECTION!
Possible setup no. 2 - Service/Virtual Server
This one is a bit different from your usual port forwarding but is pratically still the same.
Port forwarding won't be called port forwarding on your router but it'll be called 'service/virtual server' honestly there's no difference here other than the name.
Let's start off with the usual.
Go over to your router page found by typing in your default gateway into your browser.
How do you find your default gateway? Open your cmd.exe and type in ipconfig which will show you your default gateway 2 lines below your IPv4.
In the picture below my default gateway is 192.168.0.1.
Once you are on your router page navigate towards create a service/virtual server.
Something similar to this will show up.
Now don't get scared by the different language shown here. Let me quickly explain in order what those words mean. What you're looking at is Internal IP-adress / Begin port / End port / Protocol / Activated.
Your internal IP adress is your IPv4 shown above your default gateway. Your begin port and end port should be the same and is the port you are trying to open. Protocol is either UDP or TCP or BOTH. You will want to choose BOTH! If it asks you for a service name you can type in whatever, just make sure that you remember it!
Now that you know all this, this is what it should look like filled in. (In this picture I have opened port 30000)
Now that you've filled it in and everything is correct hit 'save changes'. Now this is where your port forwarding is different from the usual. Once you've hit save changes you will want to navigate over to your router's firewall. (Usually found somewhere in security/basic settings)
-----------------------------------ADD PICTURE --------------------------------------
Here it will give you the option of letting a service through the firewall. You will want to add the service you just created and let it through the firewall or your port will remain CLOSED.
Usually this is done by clicking add, choosing the name of the service and then defining if you want to let it through or not. You will want to allow it and that concludes your port forwarding. Read the 'testing your port' category on how to PROPERLY test your port. DON'T TEST IT ON YOUR OWN, GO READ THAT SECTION!
------------------------------- ADD PICTURE ---------------------------------------
* - Purple Kief - Jul 4, 2016
Port forwarding (VPN)
Port forwarding through a VPN is way easier and simplified.
It is also HIGHLY recommended that you use one regardless of your intentions. Due to it being way simpler I can just make steps instead of complicated and long explanations.
CrypticVPN
Spoiler (Click to View)
- Connect to the server you wish to use.
- Go to the crypticvpn.com website, log in and navigate to the VPN control panel and from there to the 'open port' section.
![[Image: E9pknus.png]](https://i.imgur.com/E9pknus.png)
- In port fill in the port you wish to open. (recommend any port between 10k and 60k)
- Internal IP is your IPv4 which should start with 10.8 if you are properly connected to the VPN. (Keep in mind you have multiple IPv4 make sure you get the right one!)
- Location will be the server you are currently connected to.
- In the picture below you will see me open port 12521 on the amsterdam servers.
![[Image: TCogJ9u.png]](https://i.imgur.com/TCogJ9u.png)
- That concludes port forwarding through crypticVPN. Read the 'testing your port' category on how to PROPERLY test your port. DON'T TEST IT ON YOUR OWN, GO READ THAT SECTION!
Ra4wVPN
Spoiler (Click to View)
- Connect to the server you wish to use.
- Go over to the ra4wvpn.com website, login and navigate to where you open ports.
- -------------------------------- ADD PICTURE ----------------------------------------
- In port fill in the port you wish to open. (recommend any port between 10k and 60k)
- Internal IP is your IPv4 which should start with 10.8 if you are properly connected to the VPN. (Keep in mind you have multiple IPv4 make sure you get the right one!)
- Location will be the server you are currently connected to.
- In the picture below you will see me open port 12521 on the XXXXX servers.
- ------------------------------- ADD PICTURE -----------------------------------------
- That concludes port forwarding through ra4wvpn. Read the 'testing your port' category on how to PROPERLY test your port. DON'T TEST IT ON YOUR OWN, GO READ THAT SECTION!
143VPN
Spoiler (Click to View)
- Connect to the server you wish to port forward on.
- Go to 143vpn.com and click 'port forwarding' at the top right.
- Log in using your VPN info, not the login for the website itself!
- You should now be on this page.
![[Image: ps5EgdX.png]](https://i.imgur.com/ps5EgdX.png)
- Choose any port between 10 - 60k
- The internal IP adress is your IPv4 which you can find by opening your cmd.exe and typing in 'ipconfig' without the ''. It should start with 10.8.
- Keep in mind you have multiple IPv4 so make sure you get the right one!
- Choose the server you're connected to and hit 'submit'.
- If done correctly you should see this.
![[Image: p2hoVmP.png]](https://i.imgur.com/p2hoVmP.png)
- That concludes port forwarding through 143VPN. Read the 'testing your port' category on how to PROPERLY test your port. DON'T TEST IT ON YOUR OWN, GO READ THAT SECTION!
Testing your port
Open the spoiler of your RAT below for further instructions on how to check your port.
PAID
Orcus
Spoiler (Click to View)
- Connect to your VPN if you are using one. If not skip this step.
- Completely disable your firewall! (VERY IMPORTANT)
- Open orcus main administration and click on 'create a new server'.
![[Image: MoLgmHY.png]](https://i.imgur.com/MoLgmHY.png)
- IP-adress is your IPv4 and port is the port you opened. When you filled those in hit 'add'. Password can be whatever you choose.
- This is what the end result shoud look like. (using your own IPv4 and port)
![[Image: oqMTlws.png]](https://i.imgur.com/oqMTlws.png)
- When you've achieved that end result click 'build' and save that server somewhere.
- Open the server and you should see the following. (with your own IPv4 and port)
![[Image: CjzrXPG.png]](https://i.imgur.com/CjzrXPG.png)
- Now the server is running go to canyouseeme.org and fill in the port you opened.
- It should say succes if done properly
RevCode Webmonitor
Spoiler (Click to View)
You don't have to port forward. Yeah you can enjoy that.
Imminent Monitor 4.3 (c# port)
Spoiler (Click to View)
- Connect to your VPN if you are using one. If not skip this step.
- Completely disable your firewall! (VERY IMPORTANT)
- Open Imminent Monitor.
- Click on settings.
- Right click in the open field and click on add port.
![[Image: KpH0Ka2.png]](https://i.imgur.com/KpH0Ka2.png)
- When you've added the port you opened at the bottom right click on 'start listening'.
- The status which previously showed as 'idle...' should now say 'listening!'.
![[Image: TTQYbPa.png]](https://i.imgur.com/TTQYbPa.png)
- Once you've done that go to canyouseeme.org fill in the port and if it says success your port is opened correctly!
* - Purple Kief - Jul 4, 2016
FREE
njRAT <-- CLICK TO DOWNLOAD! PW: Neos07
Spoiler (Click to View)
- Connect to your VPN if you are using one. If not skip this step.
- Completely disable your firewall! (VERY IMPORTANT)
- Open njRAT
- As soon as it opens you'll want to enter the port you opened and then hit 'start'.
![[Image: SQrKQpE.png]](https://i.imgur.com/SQrKQpE.png)
- Once you've done that go to canyouseeme.org fill in the port and if it says success your port is opened correctly!
google.com/open?id=0B5hJO7YTHi-hc2VqbG8zMFdPREU]Babylon <-- CLICK TO DOWNLOAD! PW: #4k53m4sdFGUMSDKFGk45tmkSDKM%l"&#¤&fsdkfmF4
Spoiler (Click to View)
- Connect to your VPN if you are using one. If not skip this step.
- Completely disable your firewall! (VERY IMPORTANT)
- Open babylon.
- At the top hit 'file' then hit 'settings'
- Right click and hit 'clear' the list will now be empty.
- Right click and hit 'add port'. Fill in the port, when it asks you for a network key fill in whatever you want but make SURE you remember it! The Adress Family is 2.
- This is what it should like if done correctly.
![[Image: flPpeYi.png]](https://i.imgur.com/flPpeYi.png)
- Hit save and save the file in the same folder as babylon.
- Then hit load and load the file you just saved.
- Go back to the main babylon client hit 'file' and then hit 'start server'.
- You should see this (with the port you specified)
![[Image: N473OnG.png]](https://i.imgur.com/N473OnG.png)
- If it shows that go to canyouseeme.org fill in the port and if it says success your port is opened correctly!
Quasar <-- CLICK TO DOWNLOAD
Spoiler (Click to View)
- Connect to your VPN if you are using one. If not skip this step.
- Completely disable your firewall! (VERY IMPORTANT)
- Open Quasar.
- At the top hit 'settings'
- It'll ask you for a 'port to listen too' fill in the port you opened there.
![[Image: Sa0tJnP.png]](https://i.imgur.com/Sa0tJnP.png)
- Once you've done that hit 'start listening'
- Once you've done that go to canyouseeme.org fill in the port and if it says success your port is opened correctly!
Darktrack
Spoiler (Click to View)
- Connect to your VPN if you are using one. If not skip this step.
- Completely disable your firewall! (VERY IMPORTANT)
- Open Darktrack
- Click on client settings
- In port no fill in your open port, password can be whatever you please.
- Once you've done that click the little '+' next to where you filled in the port and you should see this
![[Image: OGcclCz.png]](https://i.imgur.com/OGcclCz.png)
- Once you've done that go to canyouseeme.org fill in the port and if it says success your port is opened correctly!
What RAT should I buy/use?
I'm so tired of seeing these threads that I'm just going to implement a little review in this one. It'll be based on popularity and what I've personally read about that RAT.
PAID
Spoiler (Click to View)
LuminosityLink
Spoiler (Click to View)
Public opinion
+ User friendly
+ Easy to use
+ Stable
+ Excellent support
- Has a .NET dependency
- Has a region lock
Personal opinion
I feel like KFC has a nice program but it's simply out-matched by other RATs sold on the market currently. It does not help that he implemented a region block making blackhat use (looking at you reading this) pretty much impossible.
Which used to be my favorite RAT now scores at about 6.5/10.
Orcus
Spoiler (Click to View)
Public opinion
+ Not so user friendly
+ Easy to use, hard to setup
+- Stable for some, less stable for others
+ Excellent support
- Has a .NET dependency
Personal opinion
I think Orcus is going in a straight line forward. Armada is doing his best managing the product and to my knowing Sorzus (the developer) is still working hard to improve it. If you like the feel that Orcus has then you're not making a mistake buying Orcus. Keep in mind more so than other RATs Orcus depends on .NET 3.5 which is not the same as 2.0.
I'll give Orcus a 8.5 for the really high customizability and Armada being a sausage.
Imminent Monitor 5
Spoiler (Click to View)
Public opinion
+ Very stable
+ Insanely good UI
+ Good customer support
+ User friendly
- Has a .NET dependency
Personal opinion
I think Imminent Monitor is currently the top RAT sold on HF. Shockwave is a highly experienced developer and has been working on Imminent Monitor for 5 years+.
Other than Shockwave sometimes getting a bit lazy (don't we all) I really can't say anything bad about this RAT.
Going to give Imminent Monitor a well deserved 9.5/10. Not a 10 remember when it comes to coding, nothing is perfect.
RevCode Webmonitor
Spoiler (Click to View)
Public opinion
+ No portforwarding
- No customizability for your client file (DNS/Hidden is missing)
+- More information pending
Personal opinion
There's 2 things I can see straight from the bat.
- User friendlyness is ridiculous. There is no setup, literally nothing.
- This software is straight whitehat. There will ALWAYS be a double installation dialouge.
Overall I think this software is great if you're dealing with a less technical person. This would be a perfect recommendation for a dad/mom for example.
I would like to make clear though that the remote desktop stream seemed quite slow, even on a local connection. If you're all about that sweet FPS this web RAT is not for you.
FREE
Spoiler (Click to View)
njRAT
Spoiler (Click to View)
Public opinion
+ Decently stable
+ Easy to use
- No support
- Password recovery is broken (there's a fix on HF tho)
- Has a .NET dependency
Personal opinion
njRAT is the first RAT I ever used and I don't really have many complaints about it. For a free RAT I'm honestly impressed with how stable it is. Using it back when I was a noob probably using all the wrongs settings I managed to hold clients for 1 - 2 weeks. The remote desktop is decently fast too, overall it's my favorite free RAT.
My overall rating for this RAT is 7/10
Darktrack
Spoiler (Click to View)
Public opinion
- Not so stable
+- Easy to use, little harder to setup (without a guide)
+- Support (touch and go)
+ No dependencies
- Early stages = bugs
Personal opinion
First time I set up this RAT I immediatly encoutered a bug. Being experienced I decided to ignore it and it did indeed turn out to just be a visual bug. Other non-experienced members might have spent 30 min - 1h trying to fix it even tho there was no real bug there. Aside from that I heard it's not stable yet, people are losing their clients when closing the program etc. It's got a couple of cool features like the skype monitor thingy but aside from that I'm not convinced yet. (don't release something that isn't ready)
My overall rating for this RAT is 4/10
Babylon
Spoiler (Click to View)
Public opinion
+- Sorta stable
+ Easy to use
- No support
- Webcam capture is not fully programmed although it works for most
+ Has no depedendencies
Personal opinion
Babylon is probably the most recommended free RAT currently available. (together with Darktrack) My friend used to use it a lot and watching him use it it seems like an OK program. I did see him loose clients every now & then so that's worth noting. Aside from that the program works as advertised and is not bad at all.
My overall rating for this RAT is 6/10
* - Purple Kief - Jul 4, 2016
Setting up a DNS
Spoiler (Click to View)
Why do you need a DNS? Fact is that you don't NEED a DNS. But if you don't have one and your IP changes all of your clients will be gone. You don't want that now do you?
Yeah that's what I thought. Now there's 2 free DNS providers and 1 paid provider that are now accepted on HF.
FagDNS found at fagdns.su (FREE)
freenom found at freenom.com (FREE)
Armada's DNS found https://hackforums.net/showthread.php?tid=4995393 (RECOMMENDED)
I can't help you set up Armada's DNS but the instructions he gives you are more than clear. Well, let's get onto setting up the free DNS alternatives.
Freenom - Free DNS (Full credit to Neos for the pictures)
- If you plan on using a VPN connect to it right now. If not skip this step.
- Head over to freenom.com and check for an available domain.
![[Image: yTMql1A.png]](https://i.imgur.com/yTMql1A.png)
- Take one of the free ones and click on 'get it now!'
- At the right select the period you want to get it for. (You can choose upto 1 year for free!)
- As with any website you will be asked to register an email and all the other stuff. You can use random information but make sure you have access to the email!
![[Image: Uv2OPzH.png]](https://i.imgur.com/Uv2OPzH.png)
- Now that you have your domain head over to this link. https://my.freenom.com/clientarea.php?action=domains (You can navigate there by clicking on domains --> my domains)
- There you will want to click on manage domain followed by manage freenom DNS.
- Here you will be greeted by the following.
![[Image: Hbwofil.png]](https://i.imgur.com/Hbwofil.png)
- You can leave everything here as the default setting. The only thing you need to change is the target.
- The target will be the IP shown at canyouseeme.org
- Fill in that IP as the target and hit save changes. Your DNS will now be active after 10 - 20 minutes!
- You've succefully created a DNS! After waiting 20 minutes you can go onto testing.Read the testing your DNS section to check if your DNS was created properly!
Testing your DNS
Spoiler (Click to View)
You've created your DNS! Congrats man. Now let's see if it's actually working properly.
- Open your command prompt and type in the following command.
- ping 'yourdnshere' without the ''
- If you see the following but with your IP there then your DNS is working properly!
![[Image: gzrLgJa.png]](https://i.imgur.com/gzrLgJa.png)
Setting up a RAT
Read the 'testing your port' and 'testing your dns' section before going onto this!
So you've port forwarded and set up a DNS and are ready to embark on the RAT adventure?
PAID
Orcus
Spoiler (Click to View)
- Connect to a VPN if you are using one if not skip this step.
- Start by opening the Orcus server you made in the 'testing your port' section.
- Open Orcus main administration.
- IP = Your external IP found at canyouseeme.org
- Port = Your open port which you configured in the orcus server.
- Password = Your password which you configured in the orcus server.
- Hit connect and you are nog logged into your Orcus. You can now go into building a binary.
Every RAT is basically pre-configured. All that's left to do is build your binary.
Due to the max. amount of images some of these will be links instead. My apologies for this.
General settings - Enable what you feel like.
Connection
![[Image: dHcWCgT.png]](https://i.imgur.com/dHcWCgT.png)
Protection - Enable what you feel like.
Installation
![[Image: mWpJ3Ir.png]](https://i.imgur.com/mWpJ3Ir.png)
Assembly information - Fill in if you want.
Plugins - Use what you want to use.
Build - Enable orcus patcher if you're not testing! Leave it disabled if you're testing.
RevCode Webmonitor
Spoiler (Click to View)
Log in on their website https://yourusernamehere.revcode.eu/index.php and click on 'Client'.
![[Image: ejyLOqX.png]](https://i.imgur.com/ejyLOqX.png)
Install = Will make sure the client comes back upon restarting their computer. Enable if you want.
Persistence = Will prevent closure of the client process. Enable if you want.
Click on 'Generate & Download' and EXTRACT your client file (.exe) to your desktop.
Your file is now ready to be sent to your clients.
* - Purple Kief - Jul 4, 2016
Imminent Monitor 4.3 (C# port)
Spoiler (Click to View)
THINGS TO NOTE:
- Everything in module protection is your own choise.
- I personally recommend only using hide file + registry persistence.
- Everything in assembly information is optional and not necessary.
- In compile settings make sure hidden mode is ENABLED.
Imminent's startup
![[Image: KHo52Es.png]](https://imgur.com/KHo52Es.png)
FREE
njRAT
Spoiler (Click to View)
Every RAT is basically pre-configured. All that's left to do is build your binary.
Due to the max. amount of images some of these will be links instead. My apologies for this.
njRAT's startup.
![[Image: bq7FyKc.png]](https://i.imgur.com/bq7FyKc.png)
Crypter's startup.
![[Image: 0nFlzfb.png]](https://i.imgur.com/0nFlzfb.png)
Babylon
Spoiler (Click to View)
Every RAT is basically pre-configured. All that's left to do is build your binary.
Due to the max. amount of images some of these will be links instead. My apologies for this.
(What does Personal mean? It's whatever you filled in when adding the port, varies for everyone)
Babylon startup. (Just click build when you have the settings from the pictures below)
![[Image: NwpFmb2.png]](https://i.imgur.com/NwpFmb2.png)
![[Image: P88xZHV.png]](https://i.imgur.com/P88xZHV.png)
Crypter startup. (LEAVE EVERYTHING ELSE DEFAULT SETTINGS)
Quasar
Spoiler (Click to View)
Every RAT is basically pre-configured. All that's left to do is build your binary.
Due to the max. amount of images some of these will be links instead. My apologies for this.
Quasar's startup.
- Open your builder. Go to the 'connection settings' tab.
- Fill in your DNS in IP/hostname and your open port in Port.
- Click 'add host' and you should see this.
![[Image: zirAMkC.png]](https://i.imgur.com/zirAMkC.png)
- In the 'installation' tab tick 'install client' and 'run client when the computer starts'. (Feel free to use whatever settings you like just make sure you have those 2 enabled)
- Assembly and surveillance settings are your personal choise.
- When you've gone through all tabs click 'build'.
Crypters startup.
- Open your builder. Go to the 'connection settings' tab.
- Fill in your DNS in IP/hostname and your open port in Port.
- Click 'add host' and you should see this.
- In 'installation settings' make sure EVERYTHING is disabled.
- Enable the keylogger from the 'surveillance' tab if you want.
- Click build.
Darktrack
Spoiler (Click to View)
Every RAT is basically pre-configured. All that's left to do is build your binary.
Due to the max. amount of images some of these will be links instead. My apologies for this.
Darktrack's startup.
- Click on 'create server' right click on profiles and add a profile.
- Double click that profile then click on 'connection settings'.
- Click 'add IP adress' and fill in your DNS.
- At the right you have 3 boxes. Top = Your open port. Middle = Your password (configured in client settings) Bot= Client ID
- Fill in those boxes and you should have this.
![[Image: kPc4i30.png]](https://i.imgur.com/kPc4i30.png)
- Go to the 'installation' tab and tick both 'installation' and 'startup'. (change whatever you want just make sure you have those 2 settings enabled!)
- Go to the 'additional' tab and tick persistant server if you so choose.
- Go to the 'security' tab and tick what you want. (I recommend only using Anti VM-ware/PC/Virtualbox)
- Go to the 'build' tab and DON'T use the UPX option. Just click build and you are done.
Crypter's startup.
- Click on 'create server' right click on profiles and add a profile.
- Double click that profile then click on 'connection settings'.
- Click 'add IP adress' and fill in your DNS.
- At the right you have 3 boxes. Top = Your open port. Middle = Your password (configured in client settings) Bot= Client ID
- Fill in those boxes and you should have this.
- Disable EVERYTHING in every other tab and build your file in the 'build' tab. (DON'T TICK THE UPX OPTION)
How to test your stub properly
Spoiler (Click to View)
What do you mean? Test it properly?
Well, using the wrong IP inside of your builder usually leads to no connection. As most of you might think there's multiple IP's to use in multiple situations. You can find them down below.
BUILD YOUR STUB ACCORDING THE 'SETTING UP YOUR RAT' SECTION!
Alot of you are testing your stubs the wrong way, making you think things are broken while that might actually not be the case. Here's how you test your stub properly. (All of this assumes you are running your RAT on your actual pc and not somewhere else)
Where am I testing my stub?
1) On the same computer you're running your RAT on.
2) On a VM on the same computer that you're running your RAT.
3) A different computer in the same network.
4) An outside computer outside of your network.
What IP do I need for that?
1) SAME COMPUTER = localhost or 127.0.0.1
2) VM SAME COMPUTER = Your IPv4 or when using a VPN your public IP (found at canyouseeme.org)
3) Different computer same network = Your IPv4 or when using a VPN your public IP (found at canyouseeme.org)
4) Computer outside of your network = Your public IP found at canyouseeme.org or your DNS.
Couple of examples.
1) Testing on my own computer --> https://gyazo.com/26352d88a01457884aa949c5a32949e6
2) Testing on my own VM (no VPN) --> https://gyazo.com/6b9590b953c96285083efb9894c1aea2
3) Testing outside of network --> https://gyazo.com/2f3586ac057ed84882e55c3e2681d07c
HELP NO CONNECTION!!
Calm down, don't panic. This guide WILL have the fix you're looking for but start by checking the following:
- Is my stub crypted? Always test connections uncrypted! This way you'll know if it was your crypter that broke the stub or not.
- Did my AV remove it? It might not look like it, but this is the case 95% of the time. Go check if the process is actually running.
- Am I being a dumbo? Did you misread a portion of my guide? It's very possible, go read over it again.
Common RAT settings explained (open for suggestions)
Spoiler (Click to View)
- Installation/Startup: Required for your client to come back after he restarts his computer.
- Persistance/Respawn/Critical Process/: Will protect your process from being killed in the task manager.
- Mutex: It's a key preventing other RATs with the same key to run on that system. (To make sure you never run your RAT twice on accident)
- Anti Virtual Machine/VM: Prevent your RAT from being run on a virtual machine.
- Silent/Hidden mode: Required to prevent your client from noticing that your RAT is running.
- Melt: Your file will be removed when executed. (The original, not your startup process)
- Request elevation: Will request administrator permissions from your client.
- BSoD: Will generate a blue screen of death upon trying to kill your process.
Common crypter settings explained (open for suggestions)
Spoiler (Click to View)
- Inject into: Will inject your 'RAT' inside of an already existing process.
- Startup/Installation: Required for your client to come back after he restarts his computer.
- Binder: Bind an already existing file to your RAT which will open at the same time. (ex: Pictures)
- Icons: Used to change the icon from your .exe (basically a MUST)
- Assembly: Used to change the assembly from your .exe (basically a MUST)
- Melt: Your file will be removed when executed. (The original, not your startup process)
- Fake error: Will generate a fake error of your choosing to show once your file is ran.
- Extension spoofer: Allows you to spoof the extension of your .exe (not recommended to do this)
* - Purple Kief - Jul 4, 2016
Crypting your RAT
Make sure you've read setting up your RAT before going onto this!
Cyberseal
Spoiler (Click to View)
Dear god, crypting. Nightmare of many, including myself.
Sadly there's no easy way to go about it, keep trying and you'll get it FUD sometime!
- First of all you will need to figure out if you're using your crypters startup or not.
- It's usually always recommended to do this, but remains your own choise. (in most cases)
- Let's say you're crypting a .NET based RAT. (Ex. Luminosity, Orcus, Nanocore) you are confined to using the 'inject into self' option if you plan on using your RAT's startup. (Your file is likely to corrupt if you don't do this)
- If you plan on using your crypters startup or are crypting a native RAT you can use other injection methods although I myself don't personally recommend it.
- Now that you've read all of that let's get onto crypting.
RAT startup.
(I'm crypting Luminosity here for anyone wondering)
- Open up Cyberseal and choose the file to be crypted.
- Tick 'itself' and injection method I personally like to use polymorphic stairs.
![[Image: q9anfRI.png]](https://i.imgur.com/q9anfRI.png)
- Head over to the 'options' tab.
- Here you will want to choose an icon for your file. CREATE YOUR ICON USING THE FOLLOWING TUTORIAL: https://hackforums.net/showthread.php?tid=5182868
- When you've created the icon as described in the guide click 'browse' and add the icon to your file.
- Now go over to the 'assembly' tab.
- At the bottom you will see 'clone assembly' click that and clone the assembly from an existing legitimate program. (Honestly this is the part which makes crypting hard)
- You're done. Click seal and go scan your file on scan.majyx.net
- Is your file not FUD? Try different assemblies, the problem does NOT lie with your icon.
- Tried bunch of different assemblies but can't find one that works?
- Instead of changing assemblies keep the same assembly and bump your file by 20 - 60kb. (done in the options tab)
- Crypt, not FUD? Bump by 60 - 100kb, crypt. Not FUD? Bump by 100 - 160kb and repeat until it's FUD.
Crypter startup.
(I'm crypting Luminosity here for anyone wondering)
- Open up Cyberseal and choose the file to be crypted.
- Tick 'itself' and injection method I personally like to use polymorphic stairs.
- Head over to the 'options' tab.
- Here you will enable startup. Enable it and choose the folder for your file to be dropped in. (I personally prefer appdata)
![[Image: 7OkhHZc.png]](https://i.imgur.com/7OkhHZc.png)
- You will also want to choose an icon for your file. CREATE YOUR ICON USING THE FOLLOWING TUTORIAL: https://hackforums.net/showthread.php?tid=5182868
- When you've created the icon as described in the guide click 'browse' and add the icon to your file.
- Now go over to the 'assembly' tab.
- At the bottom you will see 'clone assembly' click that and clone the assembly from an existing legitimate program. (Honestly this is the part which makes crypting hard)
- Now head over to the 'others' tab.
- Here you will enable your persistence. Choose either BSoD or the regular persistence. It's not recommended to use both and I prefer the regular persistence personally.
- It's recommended to have a delayed execution altho not necessary.
- You're done. Click seal and go scan your file on scan.majyx.net
- Is your file not FUD? Try different assemblies, the problem does NOT lie with your icon.
- Tried bunch of different assemblies but can't find one that works?
- Instead of changing assemblies keep the same assembly and bump your file by 20 - 60kb. (done in the options tab)
- Crypt, not FUD? Bump by 60 - 100kb, crypt. Not FUD? Bump by 100 - 160kb and repeat until it's FUD.
Static Crypt
Spoiler (Click to View)
Dear god, crypting. Nightmare of many, including myself.
Sadly there's no easy way to go about it, keep trying and you'll get it FUD sometime!
- First of all you will need to figure out if you're using your crypters startup or not.
- It's usually always recommended to do this, but remains your own choise. (in most cases)
- Let's say you're crypting a .NET based RAT. (Ex. Luminosity, Orcus, Nanocore) you are confined to using the 'inject into self' option if you plan on using your RAT's startup. (Your file is likely to corrupt if you don't do this)
- If you plan on using your crypters startup or are crypting a native RAT you can use other injection methods although I myself don't personally recommend it.
- Now that you've read all of that let's get onto crypting.
RAT startup.
- Start by opening static crypt.
- Open the 'main' tab and choose the file you wish to encrypt.
- Click on the 'crypt' tab you'll see that your injection method will be chosen for you.
- Head over to the 'extra' tab
- At the right you will see '.exe' click that and clone the assembly from an existing legitimate program. (Honestly this is the part which makes crypting hard)
- Once you've done that go back to the 'crypt' tab and press crypt.
- You've now got a file without an icon which is likely to cause a lot of detections.
- You will want to make an icon following this tutorial. https://hackforums.net/showthread.php?tid=5182868
- Once you've got the icon open up the icon changer.
- Click on .Exe and choose the file you just crypted.
- It will give you multiple of those icons below that.
![[Image: qI8KZeR.png]](https://i.imgur.com/qI8KZeR.png)
- Choose the with the HIGHEST width and click on that.
- Now click on 'replace icon' and choose the icon you made with the tutorial earlier.
- Althought it looks like the icon didn't change, it DID. Don't worry.
- You can verify by dragging your .exe into a different folder and the icon will change.
- Your file is ready to be scanned on scan.majyx.net
- Is your file not FUD? Try different assemblies, the problem does NOT lie with your icon.
- Tried bunch of different assemblies but can't find one that works?
- Instead of changing assemblies keep the same assembly and bump your file by 20 - 60kb. (done in the options tab)
- Crypt, not FUD? Bump by 60 - 100kb, crypt. Not FUD? Bump by 100 - 160kb and repeat until it's FUD.
Crypter startup.
- Open the 'main' tab and choose the file you wish to encrypt.
- You will also want to enable 'startup' and the folder it gets dropped in. (Usually I go for %appdata%)
- You will also want to enable persistence here under 'settings.'
![[Image: 7SGcMsC.png]](https://i.imgur.com/7SGcMsC.png)
- Click on the 'crypt' tab you'll see that your injection method will be chosen for you.
- Head over to the 'extra' tab
- At the right you will see '.exe' click that and clone the assembly from an existing legitimate program. (Honestly this is the part which makes crypting hard)
- Once you've done that go back to the 'crypt' tab and press crypt.
- You've now got a file without an icon which is likely to cause a lot of detections.
- You will want to make an icon following this tutorial. https://hackforums.net/showthread.php?tid=5182868
- Once you've got the icon open up the icon changer.
- Click on .Exe and choose the file you just crypted.
- It will give you multiple of those icons below that.
- Choose the with the HIGHEST width and click on that.
- Now click on 'replace icon' and choose the icon you made with the tutorial earlier.
- Althought it looks like the icon didn't change, it DID. Don't worry.
- You can verify by dragging your .exe into a different folder and the icon will change.
- Your file is ready to be scanned on scan.majyx.net
- Is your file not FUD? Try different assemblies, the problem does NOT lie with your icon.
- Tried bunch of different assemblies but can't find one that works?
- Instead of changing assemblies keep the same assembly and bump your file by 20 - 60kb. (done in the options tab)
- Crypt, not FUD? Bump by 60 - 100kb, crypt. Not FUD? Bump by 100 - 160kb and repeat until it's FUD.
Data Protector V4
Spoiler (Click to View)
Will be updated to text when I get a higher post limit!
![[Image: bNI3gJF.png]](https://i.imgur.com/bNI3gJF.png)
![[Image: ckg3fcY.png]](https://i.imgur.com/ckg3fcY.png)
![[Image: GRG6mUT.png]](https://i.imgur.com/GRG6mUT.png)
![[Image: 7NvHYO8.png]](https://i.imgur.com/7NvHYO8.png)
Common questions (F.A.Q)
Spoiler (Click to View)
Q: What's the best RAT?
A: There is no best RAT. Every RAT has it's own strong and weak points.
Q: What's the best crypter?
A: Currently I believe Cyberseal is the best crypter around. (on 04/07/2016)
Q: Do you need a VPN?
A: No, you do not. Just like you don't need a seatbelt when driving but we all know what happens if something goes wrong and you aren't wearing one.
Q: Do you need a DNS?
A: No you don't but you'll permanently lose all your clients if your IP changes.
Q: Personal recommendations?
A: Luminositylink/Orcus with Cyberseal and crypticVPN.
Q: Where can I download Darkcomet?
A: NOWHERE! Darkcomet doesn't exit. Think of it that way.
Q: Should I buy a crypter?
A: Yes, don't even BOTHER with free crypters. Just no.
Common errors. (Taking suggestions)
Spoiler (Click to View)
Don't do ANY of this.
Spoiler (Click to View)
RAT Related
- Do not use Darkcomet for the reason that it has serious security flaws. (I will deny you help if you insist on using this RAT)
- Do not use Blackshades for the reason the police took over the product.
- Do not use NO-IP for the reason that it is monitored by Microsoft.
- Do not use duckDNS for the reason that they'll give you honeypots.
- Never use the same port for 2 RATs. (or program in general)
- Participate in banking fraud.
Crypter Related
- Use startup in both crypter and RAT.
- Use any settings in both crypter and RAT.
- Never crypt a crypted file.
- Inject into a process when using startup on a .NET RAT. (Ex. Luminosity)
- Do not cry to crypter owners about a 10/35 detection rate, it's your own fault.
- Assume scantime and runtime is the same.
- Do not use the website http://www.virustotal.com
HF products you NEED to stay away from
Spoiler (Click to View)
- Ghostcrypter - NO NO AND NO!
- Blazin hosting - Look at his damn trust scan + the amount of terrible reviews on his threads. DO NOT BUY OR TRUST!
- https://hackforums.net/forumdisplay.php?fid=136 - Everything in that damn section!
- Botnet Bible v3 - Just another money scam.
- Open for more suggestions
* - Flowerson - Jul 4, 2016
Well whats going on here o:
* - Purple Kief - Jul 4, 2016
(Jul 4, 2016 10:21 AM)Flowerson Wrote: Well whats going on here o:
My guide is complete. That's what's going on here. :D
Enjoy the read and I ask both of you that posted to remove your comments! 🤝
* - Mr. Robot - Jul 4, 2016
(Jul 4, 2016 10:23 AM)Purple Kief Wrote: My guide is complete. That's what's going on here. :D
Enjoy the read and I ask both of you that posted to remove your comments! 🤝
Great read - thanks for combining every other thread into one more or less.
* - Mr. Robot - Jul 4, 2016
(Jul 4, 2016 10:28 AM)LulzClerk Wrote: Can you just fuck off, this has already been explained thousands of times already, getting tired of your shit tbh. We don't need you to explain stuff we already know, or that has already been explained before ALOT. This is common sense
Things change over time, half the full on tutorials in the past still recommend using NO-IP which is funny as hell but at the same time can cause major issues.
OP took some time and you could look at this more as him sharing his learning curve in the hopes it helps other people.
This should still go in the tutorial section IMO as it will get better views and awareness.
* - bzrΚ - Jul 4, 2016
Great thread Kief, lots and lots of quality content here.
* - Mitlar - Jul 4, 2016
Good thread may I ask why you'er using the old version of static?
* - Purple Kief - Jul 4, 2016
(Jul 4, 2016 10:28 AM)LulzClerk Wrote: Can you just fuck off, this has already been explained thousands of times already, getting tired of your shit tbh. We don't need you to explain stuff we already know, or that has already been explained before ALOT. This is common senseHow about you fuck off? Using cracked products and telling me to fuck off, you're a joke kid.
(Jul 4, 2016 10:37 AM)ɃzRk Wrote: Great thread Kief, lots and lots of quality content here.Thanks mate, glad you appreciate it. :D
(Jul 4, 2016 10:43 AM)Lϻғϑλσ Wrote: Good thread may I ask why you'er using the old version of static?I pm'd the owner for a copy of his product just for this guide.
This was the product he gave me.
* - Cibor - Jul 4, 2016
Very cool and informative thread IMO
* - LulzClerk - Jul 4, 2016
How many times do i have to repeat myself to you so you can understand it? Cuz It's no Paypal option! Trying to figure out how i use bitcoin and as soon as i do i will purchase the software you fucking autistic retard. Don't talk like you are something, cuz you're really not.