Jul 14, 2013 06:31 AM
(This post was last modified: Jul 1, 2014 07:54 AM by times558.)
EDIT: This tutorial is now mostly obsolete since Imminent Monitor has had major updates since I made this tutorial.
This is exactly how to set up Imminent Monitor. I will be showing you how to Port Forward, how to set up No-IP and then what to do in the actual RAT.
Purchase Imminent Monitor here:
https://hackforums.net/showthread.php?tid=3393285
I DO NOT TAKE RESPONSIBILITY FOR ANYTHING THAT YOU DO WITH THE KNOWLEDGE FROM THIS THREAD. I DO NOT ENDORSE USING RATs FOR MALICIOUS USES AND REMEMBER THAT YOU ARE BREAKING THE LAW IF YOU SO.
No-IP
You will need the No-IP so that the slaves can connect to you on different computers/laptops. However if you are using a different computer you will have to re-download the Dynamic Updater Client and install it. then it should start working after you selected the hosts again. The function that the updater does is to update your ip with the no-ip so that you wont loose slaves if your ip keeps changing.
1. Go to noip.com
2. Click sign up which is at the top of the page. You will need to enter a username, password and a valid email. You will need these for ever mostly. Enter a hostname that you will remember.
Hostname https://i.imgur.com/os7HmNF.png
3. When you have entered all the details press Signup which is at the bottom (Not Get Enhanced).
Signup https://i.imgur.com/NrcigKV.png
4. Once you have signed up, you will need to go to your email and activate the code that you will receive.
5. Once your account is activated, go to the page where you will download the client to update the no-ip. Download: Here
Dynamic Client Spoiler (Click to View)
6. Once the Dynamic Update Client has downloaded, install it then login to the client when asked.
Login Spoiler (Click to View)
7. Once you have logged in, press edit hosts and check the box which is your no-ip address.
Select Hosts Spoiler (Click to View)
8. You are now done and you will use this no-ip in the IP/DNS boxes in the builders on R.A.Ts.
Portforwarding
I will be using sky to show how to portforward.
We need portforwarding so that the install/slave that we have just infected/helped (depends on which you do) can connect to your R.A.T Client.
1. Go to your start menu, type in cmd and start the app then type in "ipconfig" without the ".
cmd https://i.imgur.com/Qnx2OYV.png
2. Next go to your browser and type in the default gateway IP (Which for me is 192.168.0.1)
3. You will be asked to login into your router for sky the default user and pass is:
admin
sky
for others it might be:
admin
password
admin
pass
admin
(no password)
Login https://i.imgur.com/OU9IJAQ.png
4. Once you have logged into your router, go to the security tab then to the services part (if different router: advanced tab then virtual servers/portforwarding for other routers)
Services Spoiler (Click to View)
5. Click Add Custom Service and name it to what you want and the ports you want to portforward. Also make sure it is TCP not UDP then click Apply. (For other routers you will need to type in your IPv4 Address which is on the cmd (ipconfig) then click apply and you will be done.).
Custom Service Spoiler (Click to View)
6. Next thing you need to do is go to Firewall Rules where you will need to add an Outbound and Inbound service.
Firewall Rules Spoiler (Click to View)
7. For the Outbound service click Add (below) then select the service you will be using and change Block Always to Allow always (Leave everything else alone) then click Apply.
Outbound Services Spoiler (Click to View)
8. Now for the Inbound service press Add (below) then select the service you will be using and change Block Always to Allow always and enter your IPV4 Address which is on the cmd (ipconfig). Then finally click Apply.
Inbound Services Spoiler (Click to View)
Firewall Done Spoiler (Click to View)
9. You will need to be listening to the port on the R.A.T which you have just forwarded.
Listen Spoiler (Click to View)
10. Go to canyouseeme.org and type the port in you just forwarded and see if it has worked.
canyouseeme Spoiler (Click to View)
If you still need help vist: http://portforward.com/.
Imminent Monitor
1. Once on the home screen of Imminent Monitor, click on the Builder tab.
Spoiler (Click to View)
2. In the box next to IP/DNS, enter your No-IP Hostname.
3. In the box next to Port, enter the port that you Port Forwarded in your router.
4. Put the Server ID as anything you want. Wave your mouse over the characters in the mutex for a few seconds.
Spoiler (Click to View)
5. Go to the Installation tab.
Spoiler (Click to View)
Here, you can add the server to startup. This means it will run every time the client turns on their computer. I recommend that you use HKCU and not the other options because then it does not matter if the client is an administrator or not. At the top, you can pick where to install the file to. I recommend that you do not pick Temp as the files in the temp folder are not needed and people use tools like CCleaner a lot to clear the Temp folder. You can call the file and folder whatever you want, but if you want it to keep more hidden, I recommend that you use a name that looks legit and people wouldnt deem suspicious.
6. Go to the Protector Settings tab.
Spoiler (Click to View)
Here I recommend that you keep everything as it is. If you disable Task Manager, people will become suspicious really quick so I would not recommend it. Registry Persistance and Attempt BSOD on kill can sometimes not work and sometimes mess up the file a little from my experience so I wouldnt recommend them.
7. Go to the Assembly Settings tab.
I recommend that you just click generate until you find something good that looks legit. Also, a good thing to do is to sometimes get the title of a generated assembly and then use it as the folder and file name in the installation tab for it to look more legit.
8. Go to the Final Build Settings tab.
If you would like to give the file an icon, select 'Enable Icon Changer' and browse for the icon you want. It must be a .ico file. If you want to keep the settings saved so you do not have to type them in again if you want them again, tick 'Save Settings'. If you want the file to be crypted so that it is not detected by Anti-VIruses, select 'Crypt File (FUD)'.
9. Go out of the builder and click on 'Settings'. Here, add your Port Forwarded port and start listening. Then whenever someone runs your file, you will get them in the 'Clients' section of your RAT.
10. After the last step, you can upload your file to a website for people to download. You can also upload it on a virus scanning website if you want to see what the detection rate is. Then you are done!
Extra, important message!
If your file is crypted, DO NOT SCAN OR UPLOAD YOUR FILE ON A WEBSITE THAT DISTRIBUTES! If you do, this will make the file become detected and ruin it for everyone, meaning that you will need to wait for the coder to fix it and make it FUD (Fully UnDetectable) again. Your license will also be banned. A great thread by ᾋpthεn lists the scan and upload sites that do and do not distribute. Find it here:
List of sites that don't distribute by ᾋpthεn
Introduction
This is exactly how to set up Imminent Monitor. I will be showing you how to Port Forward, how to set up No-IP and then what to do in the actual RAT.
Purchase Imminent Monitor here:
https://hackforums.net/showthread.php?tid=3393285
I DO NOT TAKE RESPONSIBILITY FOR ANYTHING THAT YOU DO WITH THE KNOWLEDGE FROM THIS THREAD. I DO NOT ENDORSE USING RATs FOR MALICIOUS USES AND REMEMBER THAT YOU ARE BREAKING THE LAW IF YOU SO.
No-IP
You will need the No-IP so that the slaves can connect to you on different computers/laptops. However if you are using a different computer you will have to re-download the Dynamic Updater Client and install it. then it should start working after you selected the hosts again. The function that the updater does is to update your ip with the no-ip so that you wont loose slaves if your ip keeps changing.
1. Go to noip.com
2. Click sign up which is at the top of the page. You will need to enter a username, password and a valid email. You will need these for ever mostly. Enter a hostname that you will remember.
Hostname https://i.imgur.com/os7HmNF.png
3. When you have entered all the details press Signup which is at the bottom (Not Get Enhanced).
Signup https://i.imgur.com/NrcigKV.png
4. Once you have signed up, you will need to go to your email and activate the code that you will receive.
5. Once your account is activated, go to the page where you will download the client to update the no-ip. Download: Here
Dynamic Client Spoiler (Click to View)
6. Once the Dynamic Update Client has downloaded, install it then login to the client when asked.
Login Spoiler (Click to View)
![[Image: XOEYgl9.png]](https://i.imgur.com/XOEYgl9.png)
7. Once you have logged in, press edit hosts and check the box which is your no-ip address.
Select Hosts Spoiler (Click to View)
![[Image: WcAfzSl.png?1]](https://i.imgur.com/WcAfzSl.png?1)
8. You are now done and you will use this no-ip in the IP/DNS boxes in the builders on R.A.Ts.
Portforwarding
I will be using sky to show how to portforward.
We need portforwarding so that the install/slave that we have just infected/helped (depends on which you do) can connect to your R.A.T Client.
1. Go to your start menu, type in cmd and start the app then type in "ipconfig" without the ".
cmd https://i.imgur.com/Qnx2OYV.png
2. Next go to your browser and type in the default gateway IP (Which for me is 192.168.0.1)
3. You will be asked to login into your router for sky the default user and pass is:
admin
sky
for others it might be:
admin
password
admin
pass
admin
(no password)
Login https://i.imgur.com/OU9IJAQ.png
4. Once you have logged into your router, go to the security tab then to the services part (if different router: advanced tab then virtual servers/portforwarding for other routers)
Services Spoiler (Click to View)
![[Image: Bqzpqnl.png]](https://i.imgur.com/Bqzpqnl.png)
5. Click Add Custom Service and name it to what you want and the ports you want to portforward. Also make sure it is TCP not UDP then click Apply. (For other routers you will need to type in your IPv4 Address which is on the cmd (ipconfig) then click apply and you will be done.).
Custom Service Spoiler (Click to View)
![[Image: TqIBqhi.png]](https://i.imgur.com/TqIBqhi.png)
6. Next thing you need to do is go to Firewall Rules where you will need to add an Outbound and Inbound service.
Firewall Rules Spoiler (Click to View)
![[Image: ewCMnA4.png]](https://i.imgur.com/ewCMnA4.png)
7. For the Outbound service click Add (below) then select the service you will be using and change Block Always to Allow always (Leave everything else alone) then click Apply.
Outbound Services Spoiler (Click to View)
![[Image: n8R3Of0.png]](https://i.imgur.com/n8R3Of0.png)
8. Now for the Inbound service press Add (below) then select the service you will be using and change Block Always to Allow always and enter your IPV4 Address which is on the cmd (ipconfig). Then finally click Apply.
Inbound Services Spoiler (Click to View)
![[Image: KdtbcQL.png]](https://i.imgur.com/KdtbcQL.png)
Firewall Done Spoiler (Click to View)
![[Image: RnBCFEX.png]](https://i.imgur.com/RnBCFEX.png)
9. You will need to be listening to the port on the R.A.T which you have just forwarded.
Listen Spoiler (Click to View)
![[Image: DNRedq2.png]](https://i.imgur.com/DNRedq2.png)
10. Go to canyouseeme.org and type the port in you just forwarded and see if it has worked.
canyouseeme Spoiler (Click to View)
![[Image: t7CqedX.png]](https://i.imgur.com/t7CqedX.png)
If you still need help vist: http://portforward.com/.
Imminent Monitor
1. Once on the home screen of Imminent Monitor, click on the Builder tab.
Spoiler (Click to View)
![[Image: qlVj430.png]](https://i.imgur.com/qlVj430.png)
2. In the box next to IP/DNS, enter your No-IP Hostname.
3. In the box next to Port, enter the port that you Port Forwarded in your router.
4. Put the Server ID as anything you want. Wave your mouse over the characters in the mutex for a few seconds.
Spoiler (Click to View)
![[Image: YY2NsF6.png]](https://i.imgur.com/YY2NsF6.png)
5. Go to the Installation tab.
Spoiler (Click to View)
![[Image: GNsCACC.png]](https://i.imgur.com/GNsCACC.png)
Here, you can add the server to startup. This means it will run every time the client turns on their computer. I recommend that you use HKCU and not the other options because then it does not matter if the client is an administrator or not. At the top, you can pick where to install the file to. I recommend that you do not pick Temp as the files in the temp folder are not needed and people use tools like CCleaner a lot to clear the Temp folder. You can call the file and folder whatever you want, but if you want it to keep more hidden, I recommend that you use a name that looks legit and people wouldnt deem suspicious.
6. Go to the Protector Settings tab.
Spoiler (Click to View)
![[Image: O0PnD7I.png]](https://i.imgur.com/O0PnD7I.png)
Here I recommend that you keep everything as it is. If you disable Task Manager, people will become suspicious really quick so I would not recommend it. Registry Persistance and Attempt BSOD on kill can sometimes not work and sometimes mess up the file a little from my experience so I wouldnt recommend them.
7. Go to the Assembly Settings tab.
I recommend that you just click generate until you find something good that looks legit. Also, a good thing to do is to sometimes get the title of a generated assembly and then use it as the folder and file name in the installation tab for it to look more legit.
8. Go to the Final Build Settings tab.
If you would like to give the file an icon, select 'Enable Icon Changer' and browse for the icon you want. It must be a .ico file. If you want to keep the settings saved so you do not have to type them in again if you want them again, tick 'Save Settings'. If you want the file to be crypted so that it is not detected by Anti-VIruses, select 'Crypt File (FUD)'.
9. Go out of the builder and click on 'Settings'. Here, add your Port Forwarded port and start listening. Then whenever someone runs your file, you will get them in the 'Clients' section of your RAT.
10. After the last step, you can upload your file to a website for people to download. You can also upload it on a virus scanning website if you want to see what the detection rate is. Then you are done!
Extra, important message!
If your file is crypted, DO NOT SCAN OR UPLOAD YOUR FILE ON A WEBSITE THAT DISTRIBUTES! If you do, this will make the file become detected and ruin it for everyone, meaning that you will need to wait for the coder to fix it and make it FUD (Fully UnDetectable) again. Your license will also be banned. A great thread by ᾋpthεn lists the scan and upload sites that do and do not distribute. Find it here:
List of sites that don't distribute by ᾋpthεn
![[Image: eQhTFwh.gif]](https://i.imgur.com/eQhTFwh.gif)
