+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Malware, Rat, and Virus Removal (https://hackforums.net/forumdisplay.php?fid=110)
+---- Thread: Can you stop a FUD RAT by blocking outgoing connections with your firewall? (/showthread.php?tid=5893430)
Can you stop a FUD RAT by blocking outgoing connections with your firewall? - SinceBestThen - Oct 8, 2018
Let's just I use a firewall software to temporarily block all outgoing connections except browser because I need it for internet. Will this stop the RAT tool from establishing the connection? Or can browsers be infected?
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - gundamwinger - Oct 9, 2018
I think it depends on the RAT. The technologies of the RAT itself.
But most of the time, firewall can protect you.
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - SinceBestThen - Oct 13, 2018
(Oct 9, 2018 09:56 AM)gundamwinger Wrote: I think it depends on the RAT. The technologies of the RAT itself.
But most of the time, firewall can protect you.
Thanks for the input. Anyone else?
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - f1re_w1re - Oct 13, 2018
Yes, a firewall will help with this regard. After all, this is what a firewall is for. Your computer can also be configured to block all outgoing unknown connections. You can also try to determine the port that the RAT is using through a proxy or packet monitoring tool.
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - combovirus - Oct 14, 2018
There are some types of RAT/Keylogger that inject into browser and will be active when you use the browser. Try to use the best AV and hope you don't get affected. That's all you can do.
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - sh4moon - Oct 14, 2018
you would have to block everything but http. as long as the rat doesn't use http. a better option would be to simply block all connections to the rat's ip address or filter by destination port.
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - Business - Oct 14, 2018
It would be more efficient to get the stub removed from your PC.
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - Mr. Kim - Oct 14, 2018
Almost always, yes. RATS need to phone home to a C&C server. Find the server's IP, block it, and you're effectively good. You should still focus on removing the actual program from your computer, but without new commands or the ability to exfiltrate data it's essentially worthless.
RE: Can you stop a FUD RAT by blocking outgoing connections with your firewall? - Super - Oct 14, 2018
The problem is that most RAT's will automatically add an exception for their port if you're using Windows Firewall. However, if you're using something like Comodo Firewall, it can be extremely effective at stopping RAT's because there's no way to add a port exception without user intervention.
So to answer your question: Yes, you can stop a FUD rat with a good firewall.