[Business]

Samaritans RAT Help Desk

This thread will be comprised of Samaritans:

Answering RAT questions
Troubleshooting problems
Suggesting tools (RAT, DNS, VPN, etc)
Giving free advice

So that we can offer our best assistance, please be detailed when describing your issue or question. The more we know, the more we can help!

[#Skyline]

Please feel free to let know if you require any of the above. As we are happy too help.

[FallenCancer]

Is there any sort of vpn that you recommend because I don't know which to get

[Business]

Is there any sort of vpn that you recommend because I don't know which to get

For most RAT usages, you'll want a VPN that allows for port forwarding. There are many options, but any with port forwarding capabilities would work fine.

[crazy_command3r]

Crypting methods, differences between native and managed, icons (do they really make the virus detectable?), compression and file pumping. Could you explain these things? (Just a fast explaination, not a full in-depth)

[Business]

Crypting methods, differences between native and managed, icons (do they really make the virus detectable?), compression and file pumping. Could you explain these things? (Just a fast explaination, not a full in-depth)

A lot of things can cause your file to be detected. We won't be covering many crypting questions here, as many people use them for illegal purposes. You would probably get better answers in the cryptography section. 🤝

[ETH]

I need help on port forwarding anyone in samartians can help me

[Business]

I need help on port forwarding anyone in samartians can help me

I got you, PM me.

[Jacque Fresco]

Crypting methods, differences between native and managed, icons (do they really make the virus detectable?), compression and file pumping. Could you explain these things? (Just a fast explaination, not a full in-depth)

Even if Business is not interested in Helping out, because he thinks his answers can be used to help you or others fullfilling/completing blackhat activities, i will answer your question because as a reallife samaritan i learned to be completly neutral to every person and group without making any prejudices.


Both compression and file pumping are mostly only being used in the malware "industry" to make a binary less detected.

As my knowledge reaches compression is just a form of Algorhytm that can be used to make the size of the data smaller without having to fear that data gets extinct. (of course there are compressors for for example images (jpeg) that is compressing with the loss of data: https://www.labnol.org/software/tutorial...idth/5385/)

But you dont want this to have in binarys. I can't tell you exactly how compression works, since i for myself was never interested in really understanding it. Im sure you will find some more info if you search around for the names of such programs like upx or mpress (https://dzone.com/articles/packers-how-t...turing-upx). Since you then have a smaller binary as the outcome that does not look like the original one, AV's will not recognize it that fast as malware (since the signature is now changed). Common compressors/packers like upx or mpress are so much overused/public that all kind of Anti Viruses habe decompressors/unpackers so compressing a executable is no longer a nice option as long as you are not using a self coded or unknown packer.

File pumping is the cheap way to change the signature of a executable and pretty often being used in the past, but its not longer worth a thing since modern AV's have heuristics. What a file pumper does is that its adding some random bytes to the end of the file. Thats really simple.


I hope it basically answered your questions. Have a nice day (:

[sh4moon]

Crypting methods, differences between native and managed, icons (do they really make the virus detectable?), compression and file pumping. Could you explain these things? (Just a fast explaination, not a full in-depth)

crypting just encrypts specific parts of the exe (I think you can also do all of it).
to my knowledge icons don't help with av detection, but they definitely make the file more convincing to the user.

compression is a legit technique to make nonmalware more portable. in files, there's a lot of repeating of small parts of code. compression just makes it more efficient. av works by making signatures for malware. compression tends to change the signature.
file pumping just puts random data in the file to change the signature.

[UndefeatedHades]

Any assistance with finding a good DNS for ratting?

[crazy_command3r]

Thank you guys, I'm not interested in using this information in malicious actions, just letting you know.
I want to learn more about cryptography and things like that, so i can understand more how viruses and encrypted/obfuscated programs work.

[Business]

Any assistance with finding a good DNS for ratting?

I usually suggest Freenom as a free DNS service. That’ll be perfect for starting out!

[wraxu]

Is there a way I can bind my rat file with another exe.

[careswho]

Thanks for this thread!

My main question is about VPN. Is there really any way to get to use a software based RAT with a VPN which doesn't have port forwarding?

The reason I ask this is because I am looking for a VPN which is good in terms of privacy, jurisdiction and obviously price as well. So most of the VPNs which have port-forwarding are either in the 5, 9, 14 eye countries or don't have a well documented no-logging policy. My research was mainly using That One Privacy Guy's guide and I think N-o-r-d has it when it comes user privacy but unfortunately it doesn't have port-forwarding.

So is there anyway around for a software based RAT with a VPN which doesn't have port-forwarding?

Thanks,