Jun 16, 2015 08:42 AM
RAT FAQ - Frequently Asked Questions
Please use CTRL + F to find a question you are looking for.
Q: What is the best FREE RAT?
Spoiler (Click to View)
A: For quite a while Dark Comet was the number one choice for most people, although rather recently NJRat has been coded and released for free. NJRat is considered by most to be the best free RAT available. It is great for an entry-level RAT, and only requires .NET 2.0. You can view the official thread here: https://hackforums.net/showthread.php?tid=3924408
Q: What is the best PAID RAT?
Spoiler (Click to View)
A: As you can imagine, this question is debatable. Each seller is going to say his RAT is the best. Although a simple look at features and user reviews and you can figure out which RAT best suits your needs. BabylonRAT has a good reputation since it is coded in C++ (Meaning it requires no special dependencies to be installed on the user's computer). Although, people have complained about some of the features not working. RAT's to stay away from are those based on open source projects. A list of these RAT's include: LegacyLink and LizardRAT which are based on RWX-RAT.
The overall best RAT in my personal opinion (and the one I use) is LuminosityLink (Not to be mistaken with LegacyLink). The reason this RAT wins my vote is because of it's great persistence and the fact is has a Ring3Rootkit. I have yet to encounter a RAT that can botkill LuminosityLink, and Luminosity has been shown able to botkill betabot! You can find LL here: https://hackforums.net/showthread.php?tid=4778957
Q: How do I setup a RAT & How do I port forward?
Spoiler (Click to View)
A: There has already been a great thread on RAT setup. You can find it HERE!
Q: What if I can't port forward?
Spoiler (Click to View)
A: Luckily there is a simple solution, although very cheap, it isn't free. You can purchase a port-forward enabled VPN. This will send all the connections to the VPN's IP and won't allow you to port forward on your own network. Regardless, you need to traffic your RAT through a VPN anyways. I suggest Ra4wVPN, 143VPN, or Mullvad.
Q: What is crypting and how do I do it?
Spoiler (Click to View)
A: Crypting is the art of making your RAT file that you use to spread with undetected by antivirus. In order to "crypt" your file, you will need to either A) Buy a crypter off HF marketplace or B) Code your own. I suggest A, as it is the easier option for most people. Now the question comes up, which crypter should I buy? Well that depends all on your budget and which RAT you are using. Make sure if you are using a .NET RAT, the crypter is a .NET crypter. If you are using a C++ RAT, make sure your crypter is "Native". As for any sort of crypter, I suggest finding one with the LEAST amount of customers. You may be wondering why... but it is a rather simple concept. Less customers means less people will be using the encryption method. Eventually antivirus companies will find out that your "encrypted file" is actually a virus. If more and more people are using the same crypter, it will become detected sooner. So, shop around.
Q: Why can't I open my RAT server (controller)?
Spoiler (Click to View)
A: There could be multiple problems here. The first thing you always want to do when using any RAT is DISABLE YOUR ANTIVIRUS. This may seem stupid, but think how stupid of an antivirus company would let you open RATs. Hundreds of people have used the popular RATs on HF and they have been proven to be trustworthy.
Another issue could be that the RAT requires a certain .NET framework that you may not have installed. Make sure to check which .NET framework your RAT requires.
Q: How do I spread?
Spoiler (Click to View)
A: The first part you need to grasp about spreading is the 'story' behind your method. Whichever method you are using, try to believe the story. If you are saying your file is a voice chat plugin... believe the story. WHY do they need to use the voice chat plugin? A good example would be because your plugin allows surround sound in the CS:GO competitive servers so that you can hear where the person is talking from. Secondly, don't just flat out send them "crypted.exe" and tell them it's your voice plugin. Remember, your story is the truth. You need to explain to them why they should use the plugin, and try to convince them. Nobody downloads plugins from directexe download URL labeled "cryptex.exe". Come up with a good name such as "sursound1.2-installer.exe".
Long story short, spreading is all common sense. Anyone can do it if you do it correct. You don't need those spreading method books, just come up with a story and stick to it.
Q: Should I use a VPN?
Spoiler (Click to View)
A: YES! Please, use a VPN. It is worth the extra $5 to have a VPN. If you aren't using a VPN, forums that you spread on will not hesitate to report your IP. Also, if you infect someone computer-smart, they can do some damage with your IP.
I will be adding questions that people ask frequently on help desks on a regular basis.
