I created an RAT using Dark Comet. I used no-ip and port forwarding also when setting it up. I did not send the RAT to anyone but myself, however, I saw two random people suddenly appear as slaves. How could this be? I did not send this to anyone?
Random Users Showing Up on Dark Comet RAT |
These are more than likely either
A) Honeypots B) Antivirus tech's scanning your software Either way, uninstall them and dont worry about it. If you think that my post was informative, funny, or helpful; maybe donate a couple of bytes? There's a chance you'll win up to 250 bytes for donating!
Dec 5, 2015 09:21 PM
(This post was last modified: Dec 5, 2015 09:21 PM by SIM-2908357.)
(Dec 5, 2015 09:19 PM)SIM-2059193 Wrote: These are more than likely either You've pretty much covered it spot on. Just uninstall them as soon as possible, and never use the scanning/uploading website that you used ever again. (Dec 5, 2015 09:21 PM)SIM-2908357 Wrote: You've pretty much covered it spot on. know it from experience :( they're nasty. I dont think much heat comes from it though op, they might be just looking to get the encryption methods of your file if encrypted, but still uninstall. The telling signs of these honeypots will likely be an old windows version ( windows xp) and when you open remote desktop it will show weird programs or a banking screen ( see if you are keylogginG) If you think that my post was informative, funny, or helpful; maybe donate a couple of bytes? There's a chance you'll win up to 250 bytes for donating!
(Dec 5, 2015 09:32 PM)trenz0r Wrote: So when you say honeypot, you mean that they are 'RAT'ing me back? Two Random users connected to me. Also I have Kaspersky on my PC should I just run a full scan for that and will I be good? Or is this now a problem that is very hard to fix?? They are not ratting you back, you have nothing serious to worry about. All that can be said, is that if you used a crypter, it might not be FUD anymore. Also, don't use that website that you use to upload/scan again.  (Dec 5, 2015 09:42 PM)trenz0r Wrote: Thanks! But what do you mean by website I used to upload/scan? I did not upload anything. Did you mean the crypter I used? He means if you scanned the file on VirusTotal or something. Or Uploaded on a site that distributes.  (Dec 5, 2015 09:51 PM)Supreme.tm Wrote: Also, dont use no-ip, unless you want to goto jail. You should use FishDNS, its free. yeah thats right use FishDNS for more SAFE |
|
|
![[Image: boostdroid-signature.gif]](https://boostdroid.com/assets/images/boostdroid-signature.gif)