+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat โข Red Team โข Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: RATs: DNS stole all my slaves by pointing DNS to some other IP... WTF ?? (/showthread.php?tid=5503532)
RATs: DNS stole all my slaves by pointing DNS to some other IP... WTF ?? - cashf - Dec 24, 2016
Hey Guys,
I saw something REALLY interstesting:
1) I started with Ratting a few days before. Got a nice spreading method which got me round about 100 slaves every 24 hours. This went on for 2 days.
2) On day 2 some Security Researcher, not a famous one, but some guy posted a warning online about my spreading method and that people should not download my RAT's server. He also uploaded my server to virustotal and published a couple of comments on virustotal about my spreading method.
3) Now some REALLY strange thing happened: Thing is... I put 2 free DNS (dynu.com) into my RAT. Today I woke up and saw that all my slaves had been gone. My first assumption was, that the DNS got deleted. But surprisingly this was NOT the case. Both DNS still pointed to my VPS and it all looked pretty fine.
Now I started to research and found this:
The DNS (dynu.com) had pointed my DNS to some OTHER IP (!!!). IP belongs to "Frontier Communications Corporation California Santa Monica". This lasted for 2-3 hours yesterday and then they reverted the DNS BACK TO MY original VPS IP !!!
My thought is now: WHAT THE FUCK IS THIS ??? Someone seems to PLAY WITH ME... ๐ง
As far as my understanding goes... What could have happened is...
1) DNS pointed my RATs DNS to some other IP.
2) SOMEHOW they must have updated my slaves or did some other shit.
BECAUSE: Slaves do not connect any more. Slave count went from 200 to ZERO ๐๐
I am not angry about it, and I was expecting something like that. But I was expecting that they would just DELETE my DNS, but here, they seem to play some dirty game with me.
ANYONE EXPERIENCED SOMETHING LIKE THAT ??
Have a great Christmas guys...
cashf ๐๐
* - DTK-C - Dec 24, 2016
(Dec 24, 2016 07:00 PM)cashf Wrote: Hey Guys,have fun behind bars lmao
I saw something REALLY interstesting:
1) I started with Ratting a few days before. Got a nice spreading method which got me round about 100 slaves every 24 hours. This went on for 2 days.
2) On day 2 some Security Researcher, not a famous one, but some guy posted a warning online about my spreading method and that people should not download my RAT's server. He also uploaded my server to virustotal and published a couple of comments on virustotal about my spreading method.
3) Now some REALLY strange thing happened: Thing is... I put 2 free DNS (dynu.com) into my RAT. Today I woke up and saw that all my slaves had been gone. My first assumption was, that the DNS got deleted. But surprisingly this was NOT the case. Both DNS still pointed to my VPS and it all looked pretty fine.
Now I started to research and found this:
The DNS (dynu.com) had pointed my DNS to some OTHER IP (!!!). IP belongs to "Frontier Communications Corporation California Santa Monica". This lasted for 2-3 hours yesterday and then they reverted the DNS BACK TO MY original VPS IP !!!
My thought is now: WHAT THE FUCK IS THIS ??? Someone seems to PLAY WITH ME... ๐ง
As far as my understanding goes... What could have happened is...
1) DNS pointed my RATs DNS to some other IP.
2) SOMEHOW they must have updated my slaves or did some other shit.
BECAUSE: Slaves do not connect any more. Slave count went from 200 to ZERO ๐๐
I am not angry about it, and I was expecting something like that. But I was expecting that they would just DELETE my DNS, but here, they seem to play some dirty game with me.
ANYONE EXPERIENCED SOMETHING LIKE THAT ??
Have a great Christmas guys...
cashf ๐๐
* - Regulus - Dec 24, 2016
Doesn't sounds good at all.
Be careful when it comes to ratting.
Not sure why this happened but I'd keep a low profile.
* - Electrons - Dec 24, 2016
Doesn't look good mate. Relocate or fry your station.
* - Mitlar - Dec 24, 2016
As the user mentioned above I would keep low and destroy any suspicious shit on your computer. Encrypt your hard drives.
* - PixelatedBacon - Dec 24, 2016
ur so donezo m9. Destroy ur hardware or overclock ur own PC :)
* - NyQuil - Dec 24, 2016
doubt they stole your bots as when you build a rats file it is unique when it comes to the matter of a program using the data being sent back as well as the delimiter and password. even if they changed the IP to theres its not likely their using the same rat and password you are to connect to the hardcoded file on the clients computer.
* - Sheeple - Dec 24, 2016
(Dec 24, 2016 08:44 PM)Lฯปาฯฮปฯ Wrote: As the user mentioned above I would keep low and destroy any suspicious shit on your computer. Encrypt your hard drives.
Encrypting your hard drives would be the worst,and most pointless, thing to do.
* - Rhez - Dec 24, 2016
I think it's not possible to transfer the client to another because of the encrypted packets. ๐คจ Maybe you just lost the slave because of the changing IP.
* - JoshuTee - Dec 25, 2016
They're probably going to try to steal your clients to uninstall your server
* - Purple Kief - Dec 25, 2016
"Frontier Communications Corporation California Santa Monica".
Research the shit out of that. If it's legit I'd prepare your butthole.
* - eiqhtz - Dec 25, 2016
(Dec 25, 2016 03:15 PM)Purple Kief Wrote: "Frontier Communications Corporation California Santa Monica".
Research the shit out of that. If it's legit I'd prepare your butthole.
It's a telecommunications company. Provides internet, home phone, etc
https://en.m.wikipedia.org/wiki/Frontier_Communications
* - Purple Kief - Dec 25, 2016
(Dec 25, 2016 03:22 PM)eiqhtz Wrote: It's a telecommunications company. Provides internet, home phone, etc
https://en.m.wikipedia.org/wiki/Frontier_Communications
So pretty much an internet provider redirrected all traffic to their servers?
OP if you are 100% sure about this you are screwed. No sugarcoating it lol.
* - eiqhtz - Dec 25, 2016
(Dec 25, 2016 03:33 PM)Purple Kief Wrote: So pretty much an internet provider redirrected all traffic to their servers?
OP if you are 100% sure about this you are screwed. No sugarcoating it lol.
It could be that they're assisting in an investigation on OP as well.
* - Ainaj - Dec 25, 2016
(Dec 25, 2016 03:38 PM)eiqhtz Wrote: It could be that they're assisting in an investigation on OP as well.
One can only wish