[Bastille]

I stumbled uppon a thread a day ago of someone who wanted to sell and share a RAT. The thread has been removed since because OP shared an autobuy link which is not allowed, from the Help Docs.

I saved the thread, links, everything to conduct a malware analysis.

On his website there are "Premium Version" for 20$ only, and "Free Version". Both of these version have 3 elements :
- MadStealer
- MadRat
- MadMobile (.apk)



I went with MadRat, here is what it looks like after being unzipped :



Python based malware, the "click to install python.exe" file is legit, md5sum = a55e9c1e6421c84a4bd8b4be41492f51
READme.txt :

Code

Python 3.10 or above must be installed!
Internet connection must be available!
Disable your antivirus/defender as it might delete some important files!

Run "MadRat.exe"


use the "click to install python.exe" file if you don't have it
use cntrl+v to paste text, and cntrl+c to copy

VT report : https://www.virustotal.com/gui/file/c656...?nocache=1

I've ran it throught TRIA.GE, I got many cmd windows popping and disappearing as you can see in the taskbar here :



Checking the TRIA.GE report it's flagged 10 out of 10 : https://tria.ge/251012-l1ajhssqt5/behavioral1



Few artifacts :

Code

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

(obfusctaed)
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:gzIgUJafynlh{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$lGZpHFxMpQWjKR,[Parameter(Position=1)][Type]$hAtUBJIkjY)$BJiJtWzUpwt=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Ref

(Uninstalling Windows Malware Removal Tool)
C:\Windows\system32\wusa.exe : wusa  /uninstall /kb:890830 /quiet /norestart

Dropped and executed 4 other .exe files :
mad.exe : https://www.virustotal.com/gui/file/c40e...15b864c78d
pyrdzldsgjog.exe : https://www.virustotal.com/gui/file/d23c...9fafa7b933
jwm140.exe : https://www.virustotal.com/gui/file/bc6d...aa417b5ded
updater.exe : https://www.virustotal.com/gui/file/8172...91b1a8620b

---

Nostre : https://hackforums.net/member.php?action...id=5703281
In case you want to ban, thanks

[Nostre]

Great work as always, Bastille

[CL1B]

What a weeb.

Thank you for this read and analysis Bastille

I would love to subscribe to these, would a mega thread be an idea? A thread that you add new analysis too when you do them?

[Bastille]

What a weeb.

Thank you for this read and analysis Bastille

I would love to subscribe to these, would a mega thread be an idea? A thread that you add new analysis too when you do them?

Thanks mate

I already have a mega thread, while I was Staff I was able to edit old threads, but now I can't anymore so I can't add the new analysis, the alternative would be to get the Vendor role but can't afford to spend 150$ for this

Here is the thread I used to maintain : https://hackforums.net/showthread.php?tid=6276795

[CL1B]

Ah ok, I understand..

[MadScientist]

Awesome work bro, keeping the forums safe! Imagine PAYING someone to infect yourself >.<

[Hackers]

Nice catch, these types of users are becoming more common on HF & other sites where there are lots of devs and people trying indie tools

[JoseMar]

Nice work my friend, as always.
You know what sucks the most? There are so many people who actually fall for it… For example, look at my last thread about what’s happening on YouTube (From long time but 2025 are... insane)

• https://hackforums.net/showthread.php?tid=6312259
  

Of course, that so-called LEGIT TOOL fits perfectly with what these hypocrites are doing there.

Nice one.🕵️🙂