New user to rats - Is there a rat that can connect to the server through a Tor hidden service? I like to use Tor hidden services for a lot of stuff because it hides my ip and I don't have to have access to the networks admin tools to set up port forwarding? I can't think of a reason this couldn't be done and I think it would be a lot safer than configuring an ip in the client. I'm pretty sure I could code this pretty easily so I would think this would be something that can be done somehow or there is something I am missing. I get that the vnc protocol could potentially be too slow - but not necessarilly, and even just running shell commands, key logging, file explorer etc would be pretty good for the privacy trade-off.
I'm a total noob so I'm sorry if this is a stupid question.
People have asked before. The answer has always been no. Can't remember if I've asked I_H8_KDot about this. It probably wouldn't be hard to make a RAT plugin with a Tor client, but any enterprise firewall worth the name should block it. It's a major red flag.
ahh yeah that makes sense, thank you!
(Jul 28, 2026 03:15 PM)DramaKing Wrote: People have asked before. The answer has always been no. Can't remember if I've asked I_H8_KDot about this. It probably wouldn't be hard to make a RAT plugin with a Tor client, but any enterprise firewall worth the name should block it. It's a major red flag.
I somewhat looked into it but for something like Overlord that has streaming and websockets it just isn't possible pretty much. If you were to make a http loader on the other hand and just have requests for everything, that would be a LOT more doable.
Make Malware Great Again
But Tor doesn't really increase your OpSec much beyond proper methods and will dramatically increase latency and decrease bandwidth, although if you can't afford a VPS and are nervous about port forwarding, I can understand.
(Jul 28, 2026 04:56 PM)I_H8_KDot Wrote: I somewhat looked into it but for something like Overlord that has streaming and websockets it just isn't possible pretty much. If you were to make a http loader on the other hand and just have requests for everything, that would be a LOT more doable.
here's another open source thing to sign your name to https://github.com/wbenny/mini-tor
you can pull the B method and drop the whole tor lib to disk and convert the url to v3.
It's possible. I've seen many people do it before, and most of them used private RATs. However, nearly all of them were quite slow. If you don't plan to use bandwidth-intensive features like screen recording, it can work. That said, running a RAT network over Tor can eventually become a nightmare, and you may experience frequent connection drops.
(Jul 28, 2026 04:56 PM)I_H8_KDot Wrote: I somewhat looked into it but for something like Overlord that has streaming and websockets it just isn't possible pretty much. If you were to make a http loader on the other hand and just have requests for everything, that would be a LOT more doable.
I have no problem paying for a VPS. Can you recommend one that is No-KYC and will accept crypto payment? I have found some options via google but all have mixed review. I think I am going to start by trying Overlord.
(Jul 30, 2026 01:17 PM)MaMaSmurf2004 Wrote: I have no problem paying for a VPS. Can you recommend one that is No-KYC and will accept crypto payment? I have found some options via google but all have mixed review. I think I am going to start by trying Overlord.
kyun.sh
Make Malware Great Again
It's possible,but too slow for RAT, maybe this method for stealer is cool. bcz stealer only needs to upload a compressed file.
if u use this method in RAT, functions like hvnc, vnc etc will ruin your patience.
The method has 2 approach:
1. Stageless, hide the tor in your stub and when stub is running in PC, it will release on the disk and run tor service in local silently by commandline. it will open port like: 127.0.0.1:9050 etc or you point a specific port. and your stub's traffic all send to this.
2. Stager, download the tor from the tor project official website or your server and run it in local, the next steps are like in approach 1
Both of these approaches need to create a new process.
|
