+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Remote Administration Tools (https://hackforums.net/forumdisplay.php?fid=114)
+---- Thread: What are some RATS that support tor?? (/showthread.php?tid=6291203)
What are some RATS that support tor?? - SIM-5186353 - Feb 2, 2025
I'm currently searching for a RAT that supports Tor. I tried many: Zyklon, BitRAT, Orcus, Venom... but none are working.
Zyklon and BitRAT support Tor natively, but they aren’t working as expected.
With Orcus, I built the payload using a SOCKS5 proxy like this:
proxy_ip:port
However, the client connects briefly and then disconnects immediately, or it doesn't connect at all. I've ensured that Tor is running correctly, and the SOCKS5 proxy is set up properly, but still no success.
I also tried adjusting the payload settings, but the issue persists. The client doesn’t seem to be able to route its connection through the Tor network.
Has anyone successfully used Orcus or any other RAT with Tor? Any advice or specific configurations that might help get this working?
Thankss!! ✌
RE: What are some RATS that support tor?? - Binance - Feb 2, 2025
Hello,
TOR in a RAT is one of those things that is GREAT in theory, but idiotic in implementation considering the unpredictable congestion of the TOR network. In tandem with this, the .exe or binary would typically need to be packed with a portable tor library which grossly inflates the size. Unfortunately there is a plethora of errors if this library is fed directly into RunPE/memory which effects direct callback functions thus the lib must be dropped to disk...
and well... when its dropped to disk...
You know.
There is only one effective loader on the market which outputs browser extension format whilst utilizing the TOR network, but it works as a simple download and execute function; and Matanbuchus' price out-classes it from just any malware actor.
I would abandon this idea.