[lostspirite]

for 3 times today 3 weird computers (VPS i think) open my keyllo and start doing some weird analyse , i didnt understund what actually they were doing so i uninstalled it from their computers , do you know what they were trying to do please?

the first one was from russa
seconde from USA
third from germany

i actually asked a frind about that, he said that they was resolving my dns and trying to steal my slaves is that true?

[Nomad.Null]

Entirely possible. This is why you are not a real hacker, you're just a RATing skid. If you actually knew what the traffic looked like, you'd know how to handle this. I'm not trying to rip on you, but I get a little frustrated when I see something like this. At the very least, you did the right thing by uninstalling, because now he cannot further disassemble your RAT and potentially discover who and where you are...unless he took a copy and put it on an offline machine or sandbox for forensic purposes.

If he did copy your RAT or disassembled it before you could delete it, this is what is likely happening:

• You probably ratted a real hacker who knows how to detect and trace a reverse-TCP connection.
  


• If he hasn't already succeeded, he probably is in the process of reverse-engineering your RAT and uncovered its settings, which would have included the DNS hostname you use to redirect the connection back to the botnet master, your personal, home computer.
  


• He is now following that Reverse-TCP connection in order to figure out what your DNS hostname is. He then would run an NSlookup to find out what the real DNS is, rather than your free sub-domain. Let me guess, you use freedns.afraid.org?
  


• He will then proceed to resolve your IP address simply by running a reverse-DNS query, which gives him an IP address that he can now resolve with WHOIS and geolocation to figure out your general area and further resolve your identity based on information from your ISP, assuming he has the authority or skill to acquire that kind of information.
  


• He will then begin scanning your home network to determine whether you are an enterprise that is doing something illicit, or if you are one of thousands of kids who RAT in their spare time for the giggles. He can then decide if you are a soft enough target to attack himself or if he wants to get the authorities to come after you for computer crimes.
  


• Depending on how malicious he is, he may decided to attempt to resolve your personal information from your IP address by social-engineering your ISP or simply getting the police involved.
  


• If he truly desires to come after you after following the preceeding steps, he could do any of the following: Swat you, penetrate your network/pc, come to your house to confront you, etc...
  

In short, you fucked up, sir. You deleted the RAT, but it may have come too late for all you know. The only reason you would have been touched from multiple countries like that is if someone with a rather sophisticated VPS network or a pre-paid VPN decided to scan you from different locations. Chances are though, if three different scans were touching your Dynamic DNS, then that means he is already onto you and has all the information he needs to track you down.

I would advise changing your Dynamic DNS hostnames/addresses and change you network IP address. If it is static, call your ISP and have them change it. But the best advice I could offer is that you stop RATing. I rarely see it become profitable and it's simply not an intelligent thing to do...

[moorbes]

Entirely possible. This is why you are not a real hacker, you're just a RATing skid. If you actually knew what the traffic looked like, you'd know how to handle this. I'm not trying to rip on you, but I get a little frustrated when I see something like this. At the very least, you did the right thing by uninstalling, because now he cannot further disassemble your RAT and potentially discover who and where you are...unless he took a copy and put it on an offline machine or sandbox for forensic purposes.

If he did copy your RAT or disassembled it before you could delete it, this is what is likely happening:

• You probably ratted a real hacker who knows how to detect and trace a reverse-TCP connection.
  


• If he hasn't already succeeded, he probably is in the process of reverse-engineering your RAT and uncovered its settings, which would have included the DNS hostname you use to redirect the connection back to the botnet master, your personal, home computer.
  


• He is now following that Reverse-TCP connection in order to figure out what your DNS hostname is. He then would run an NSlookup to find out what the real DNS is, rather than your free sub-domain. Let me guess, you use freedns.afraid.org?
  


• He will then proceed to resolve your IP address simply by running a reverse-DNS query, which gives him an IP address that he can now resolve with WHOIS and geolocation to figure out your general area and further resolve your identity based on information from your ISP, assuming he has the authority or skill to acquire that kind of information.
  


• He will then begin scanning your home network to determine whether you are an enterprise that is doing something illicit, or if you are one of thousands of kids who RAT in their spare time for the giggles. He can then decide if you are a soft enough target to attack himself or if he wants to get the authorities to come after you for computer crimes.
  


• Depending on how malicious he is, he may decided to attempt to resolve your personal information from your IP address by social-engineering your ISP or simply getting the police involved.
  


• If he truly desires to come after you after following the preceeding steps, he could do any of the following: Swat you, penetrate your network/pc, come to your house to confront you, etc...
  

In short, you fucked up, sir. You deleted the RAT, but it may have come too late for all you know. The only reason you would have been touched from multiple countries like that is if someone with a rather sophisticated VPS network or a pre-paid VPN decided to scan you from different locations. Chances are though, if three different scans were touching your Dynamic DNS, then that means he is already onto you and has all the information he needs to track you down.

I would advise changing your Dynamic DNS hostnames/addresses and change you network IP address. If it is static, call your ISP and have them change it. But the best advice I could offer is that you stop RATing. I rarely see it become profitable and it's simply not an intelligent thing to do...

@True demon , Bro if I were the guy who made this thread after I'd read your reply, I'd just go and throw my laptop.

the things he said are totally true he can do these all.

I'd also suggest you to stop "RATing", at least use a vps under a vpn , like do you even read how things like dyndns and other free services work.

You're not hidden at all,you just gave your IP address a name.

[lostspirite]

thanks for those values information True Demen , btw im a huge fun of you i love you're e-books .
im actually using a VPS for rat and im not a skid im simply a noob , im Learning and i do not consider my self as a hacker.
but i dont know why the hell some one would be intrested on spying me? i start rating 2 days ago and i do it just for experience .

ps : sry for my English .

[Nomad.Null]

thanks for those values information True Demen , btw im a huge fun of you i love you're e-books .
im actually using a VPS for rat and im not a skid im simply a noob , im Learning and i do not consider my self as a hacker.
but i dont know why the hell some one would be intrested on spying me? i start rating 2 days ago and i do it just for experience .

ps : sry for my English .

Thank you for reading. I am just trying to tell you that you are putting yourself at unnecessary risk.

Also, a skid is someone who uses the scripts and tools of other hackers without understanding how they work or what they do. You are still a skid. It's okay to be a skid. Everyone starts as a skid. I was a skid for many years. It is much better to know you are a skid and be humble about it so that you can learn.

Nevertheless, I am not trying to rip on you, I am trying to warn you. The person who is "spying" on you already knows you are a ratter. He is either trying to steal your Zombies/slaves or he is trying to catch you. That is the only reason. You simply infected the wrong person.

Continue using the VPS and potentially a VPN as well. Be more careful...but I still say you should not RAT. The risk is not worth the reward and it doesn't teach you anything.

---

@True demon , Bro if I were the guy who made this thread after I'd read your reply, I'd just go and throw my laptop.

Lol, well...that wouldn't really help you much... the laptop isn't the problem. It is the dynamic DNS which is resolving your IP address continually. Your home IP is what is being updated to the dynamic DNS. Simply updating the RATs with an alternate hostname/dns and dumping the old hostname will make it so that your RATs no longer look to the old/compromised one for your IP address. This is how you guarantee you do not lose slaves, even in situations like this. But you have to move fast. You have hours to act, minutes if the guy tracking you is really good...

You have to destroy your compromised RAT, dump the old DNS and replace it with a new one, and change your network IP to avoid exposure, or alter your VPN, if you are worried about being deanonymized by them. Some VPNS will happily rat you out to the authorities to save themselves a lawsuit.

[lostspirite]

thanks alot True Demon , its true the risk is not worthy !