[v0ise]

So I have my test computer infected with my Cerberus RAT (NOT crypted). The computer has A/V active but I made an exception to the location of where the RAT is installed--essentially the entire \Windows directory. It works at first but after around 10 hours the victim no longer shows up on my list. The computer does go through a number of sleep, wake-up cycles but it eventually drops connection to my victim. Any ideas why? Could it be because of how it's not crypted? I've configured the RAT correctly so I don't think it's an issue with that. I have the correct ports forwarded on my end too so nothing wrong there. If I go to my test computer, kill the process, and wait for the process to come back via persistence it shows up on my computer. I don't want my actual victims in the future to drop connections so I want to figure this out!! Please help!!

---

Oh and also, when I go to my test computer the process for my RAT is still running but I still don't see the computer on my list. Why is that happening?! Is Cerberus known to do that?

[tux1]

All rats/keyloggers will lose bots you just have to accept it. If your server isn't crypted then it will get detected by AV much more.

[v0ise]

Any suggestions as to which RAT lose the least amount of bots?

[tux1]

I think darkcomet is pretty stable but if you want to pay for one I think blackshades is good too.