+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: How to hide RAT from task manager? (/showthread.php?tid=5953006)
How to hide RAT from task manager? - Cyamic - Mar 21, 2019
Hello. I am fairly new to ratting and I only know the basics to it like crypting and port forwarding to setup the rat. I am wondering if there is any way to hide the rat I have created from the victims task manager. I am trying to not let my rat show up so its not obvious. Is there anything I can do to hide this? Anything would help me, thanks :).
RE: How to hide RAT from task manager? - I.M.P - Mar 21, 2019
I assume that
A. You have the source code (or can edit the stubs code in some way) to this rat
B. Your okay with loosing the client every time they open task manager
C. Have some FUD watchdog program to keep the task alive after they close task manager
Assuming all these conditions are met it should be fairly simple
RE: How to hide RAT from task manager? - SoonTM - Mar 21, 2019
A rootkit would do the trick.
RE: How to hide RAT from task manager? - Silent hill - Mar 23, 2019
(Mar 21, 2019 06:24 PM)Atroxcity Wrote: I assume that
A. You have the source code (or can edit the stubs code in some way) to this rat
B. Your okay with loosing the client every time they open task manager
C. Have some FUD watchdog program to keep the task alive after they close task manager
Assuming all these conditions are met it should be fairly simple
100% d) also you can inject it into any legit process.
RE: How to hide RAT from task manager? - NYANxCAT - Mar 23, 2019
the simplest solution is to make your RAT kill itself every time task manager is open.
then start your RAT again using windows task schedule.
It's very simple and basic.
RE: How to hide RAT from task manager? - iCoreX - Mar 23, 2019
(Mar 23, 2019 04:25 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: the simplest solution is to make your RAT kill itself every time task manager is open.
then start your RAT again using windows task schedule.
It's very simple and basic.
What do you mean with "using windows task schedule"? How can it detect that taskmanager is closed?
RE: How to hide RAT from task manager? - Onireves - Mar 23, 2019
You can always give it a legit name and icon, and no one will suspect :)
RE: How to hide RAT from task manager? - iCoreX - Mar 23, 2019
(Mar 23, 2019 07:12 AM)Onireves Wrote: You can always give it a legit name and icon, and no one will suspect :)
True, I always name my stub "svchost" and everytime they look in taskmanager they never find it lol
RE: How to hide RAT from task manager? - Goku - Mar 23, 2019
you guys make me paranoid...
RE: How to hide RAT from task manager? - int - Mar 23, 2019
the real chads name their stub some fishy shit and then make it unkillable in tskmgr
RE: How to hide RAT from task manager? - WhatTheLeak - Mar 23, 2019
(Mar 23, 2019 04:25 AM)˗ˏˋ NYAN CAT ˎˊ˗ Wrote: the simplest solution is to make your RAT kill itself every time task manager is open.
then start your RAT again using windows task schedule.
It's very simple and basic.
Does any RAT has this feature? Or is it more like a crypter feature?
RE: How to hide RAT from task manager? - Zexture - Mar 23, 2019
The rat should be programmed as a driver
RE: How to hide RAT from task manager? - Exodus - Mar 23, 2019
(Mar 23, 2019 03:02 PM)Zexture Wrote: The rat should be programmed as a driver
Drivers can't be installed without being digitally signed.
RE: How to hide RAT from task manager? - Zexture - Mar 23, 2019
(Mar 23, 2019 03:05 PM)Exodus Wrote: Drivers can't be installed without being digitally signed.
Ahh Thanks never knew that. But I believe you can disable it
RE: How to hide RAT from task manager? - NYANxCAT - Mar 23, 2019
(Mar 23, 2019 03:01 PM)WhatTheLeak Wrote: Does any RAT has this feature? Or is it more like a crypter feature?
It's just an idea, you can code it as a rat feature or crypter feature. It's simple yet efficient