[Nickname.]

Okay so title says it pretty much,

What kind of traces does a BIN leave.

So the file you make with your builder. (Stub)

What kind of info can you find in the bin? That could trace to yourself

[Rhez]

The stub contain your info like email/password/dns address/port/etc and it was encrypted(not all the time). When your stub was reverse engineered, then all your info will be exposed.
Talking on a RAT Stub, it will leave some traces on your clients like if you disable taskmanager/cmd, registry will be changed.

[Purple Kief]

Everything you configure inside of your builder will be left behind by your bin.

[Vuln]

It all depends on the RAT (and crypter if one is used) and its settings. The startup method would probably be the most common "trace" (apart from the process and the file itself obviously). It is usually either a registry key, a scheduled task, or an executable file in the Startup folder.

And keep in mind that some programs or (router) firewalls may be monitoring and logging outbound connections.

What kind of info can you find in the bin? That could trace to yourself

Everything your stub can do is stored (at least initially, but usually forever) in the stub itself. This includes your DNS hostname (IP address and port number), considering it has to connect to the server.

[Nickname.]

The stub contain your info like email/password/dns address/port/etc and it was encrypted(not all the time). When your stub was reverse engineered, then all your info will be exposed.
Talking on a RAT Stub, it will leave some traces on your clients like if you disable taskmanager/cmd, registry will be changed.

How about my mac adress does that leave any traces?

---

It all depends on the RAT (and crypter if one is used) and its settings. The startup method would probably be the most common "trace" (apart from the process and the file itself obviously). It is usually either a registry key, a scheduled task, or an executable file in the Startup folder.

And keep in mind that some programs or (router) firewalls may be monitoring and logging outbound connections.


Everything your stub can do is stored (at least initially, but usually forever) in the stub itself. This includes your DNS hostname (IP address and port number), considering it has to connect to the server.

So what would be the best way too work?

So if I would use a RDP for a rat then the binary can never trace back to my computer right.

[Mr 4rs4l4ne]

When you finish your job, u need to uninstall your stub from your victim pc.
Have a good day .

[Nickname.]

When you finish your job, u need to uninstall your stub from your victim pc.
Have a good day .

Lol this would still leave traces

[Vuln]

How about my mac adress does that leave any traces?

There are no MAC addresses stored in the stub, if that's what you're asking.

So if I would use a RDP for a rat then the binary can never trace back to my computer right.

Even if you managed to anonymously obtain an RDP that doesn't log anything at all, then the ISP most likely will.
Being completely untraceable by anyone is harder than you think, especially if you're not using public networks and computers.

But needless to say, most RAT users aren't getting traced, just because they aren't worth tracing.

[Joey Pirtz]

FYI the term you are looking for is 'whaling'. Use the search function and you'll find plenty of tuts on how it's done and what you can find.