How to Know if You Are Infected with RATs or Keyloggers

How to Know if You Are Infected with RATs or Keyloggers

In this post i am going to show you how to find out when you are infected with a RAT or Keylogger without using any complex tools. Now i believe most of you might know that you need to have an internet connection to make a RAT or a Keylogger work, which would mean, if you are not connected to internet, you don't have to worry about being infected with RAT or Keylogger Ok, so for those who have internet connection and think they are being infected with a Trojan, here is a little guide that can solve your problem.

1. Now every program has their own process which can be seen on task manager. So the first thing to do is to find out which process theTrojan is being attached to. If you see some unknown process search that on google. A good hacker will always makes sure he hides its process with a Windows based Process, for eg. svchost.exe or something like that.

2. If you cant find, then the next thing you can do is use cmd 
(to open cmd prompt, Click on Start--->Accessories-->Command prompt).
3. Once Command Prompt is opened, use this command: netstat -an |find /i "listening"
Note: The NETSTAT command will show you whatever ports are open or in use, but it is NOT a port scanning tool!

Now we wonder What this Command does? 
This command will show all the opening ports. Now check for any unknown port.

4. You can skip step 3 if you want, and can do this instead.

Open command prompt and type netstat -b

Now this command will show you the active connections with the process with their PID (Process Identifier) and also the packets.
Look out for SYN Packets and the Foreign address its been connecting with , check the process its been associated with, check the ports also. If you find that its connecting to some unknown ports, then you can say you have been backdoored.

5. Go to your task manager. On the top of it, 
click on View---> select Column---> Tick on PID (Process Identifier).
Match the suspicious Process with the Processes In task manager, check PID also.

Now most of the RATs resides on Start up. How to delete them from start up?
a) Go to regedit ---> HKLM\Software\Microsoft\Windows\Current version\Run
On the Right hand side, check for the process name which you find on step 4. if its not their. Check at
HKCU\Software\Microsoft\Windows\Current Version\Run
OR
Open Cmd prompt & type start msconfig. Go to Startup tab, you can check the startup process there.

I hope This Tutorial was easy and comprehensive.

Read More

How To Hack pc Using Dark Comet Rat with No ip

First go to http://www.no-ip.com/ and create a account.



Once your logged in ,add a host.




Next:

• 3 : Choose your host name.
• 4 : Your ip address
• 5 : Create host.

No-Ip is set ,now lets download the DUC to update your ip automatically!
DUC download : http://www.no-ip.com/downloads.php
Start the DUC client after installation.



Now to download DarkComet ,here can you find some info and download.

After installation ,open DarkComet client. If you don't want to use the DUC client for No-IP you can do it with DarkComet. Here is how to do it :



Now lets build the server ,go to Edit Server => Server Module.

Press Generate a few times



Next:

• 1 : Enter your no-ip host name
• 2 : Choose your port
• 3 : Test Network
• 4 : Add this to your configuration
• 5 : Click your host to set it.

Make sure you port is open! You can check it here

Next step you can choose but this is what i use ,if you don't know what to do yust copy the settings.



Same for the next one



If you want keylogs :



Now its time to build your server!



After building you need to crypt your server to get it FUD for spreading!

Now to see your vics ,press +listen ,set your port and press listen!



Hope you guys like it ,if you copy this tut give me some credit then pls.
If you have any questions feel free to ask.

Read More

HAck Email/ Computer with ProRat full Tutorial

Hack any e-mail account password

1) First of all Download ProRat

Once it is downloaded right click on the folder and choose to extract it. A password prompt will come up. The password will be "pro".

2) Open up the program. You should see the following:

 

Read More

50 Rats Collection with their Download Link

RATs Collection

I Am Not Responsible if Anything Happens to you or to your computer. Use it at your OWN risk.

AARC



Download Link: Here

Albertino Simple RAT



Download Link: Here

BlackShades 4.2 [Fake Login Server]



Download Link: Here

Read More

Cybergate Rat Tutorial How to Hack pc using Cybergate Rat

This is one of the good Tutorial..:)

Firstly, Start off by downloading Cybergate RAT:
Download Mirror 1
Download Mirror 2

Now, Go to No-ip.com

Sign Up and everything. now log in and press Add Host



Now name your host to whatever you want.. i will name my host to Cocacolanerds.no-ip.biz. Just follow theese settings and press Create Host.




Congratulations! You are done with The No-Ip! :)

Let's move on with the Cybergate RAT

Open Up Cybergate.. (Wich you downloaded in the beginning)

Now click Control Center - Start

Click Control Center - Options - Select Listening Ports And Do Following:



Good, You Are Done With The Settings! Now, let's move on to the Virus Creation :).

Click Control Center - Builder - Create Server. Make a new User named Hacking. Press Ok.



Mark the user "Hacker" And press Forward.

Now you should have something like this;



Press 127.0.0.1 | Port 999 and press Delete..:



After that, Click Add.

Now, A Box should pop up saying: 127.0.0.1:81. Like this:



Remove everything and change it with the No-ip adress you host you added.. So let's say you used example.no-ip.biz. Change 127.0.0.1 to example.no-ip.biz and the :81.. Since we used port 82, Change :81 to :82, so it should look like this:



But since my No-ip adress was cocacolanerds.no-ip.biz, i have to change it to MY. but i keep the :82...

Now Change the
Identification: remote
Password: cybergate

To This:
Identification: Cyber
Password: 123456

Good! You are now done with that :). Let's move on to "Installation"

Use the Exact same settings as i do. :



Good, We Skip Message. We Skip Keylogger. In the Anti Debug Have everything checked

In The Build Server: Use Google Chrome Passes and UPX.. (Makes the server smaller)

And press Create Server. Good, You do now have your RAT server complete!

If your RAT doesent work. check following things:

Non-Connecting RATs

1. You are properly port-forwarded if using a router.
2. You have the No-IP Client installed and running.
3. Your DNS entries are correctly spelled when building your server.
4. The password in Listening Ports and the password your server uses are identical.
5. You are Listening on the correct ports.
6. Your Firewall is letting connections through on the port you're listening on.
7. Your server is added to excluded files in your Antivirus and Firewall.
8. Your server injects explorer.exe instead of the default browser.

How to port forward..

Go to Portforward.com and lookup your Router, there shall be a guide on how to port forward on it :). and if you are on a modem.. then you don't need to port forward.

Enter Start - Run . Command. Type Ipconfig

In the "Standard Gateway", That is your Router IP. Type that into your web browser. Log in, And Port forward port: 82

Restart your router and you are done! :).. Just send the RAT Server to any slave OUTSIDE your network.

Hope you enjoyed watching this tutorial & i wish you all the best with your victims ;)

Read More

How To Hack Remote of a Computer Hack Computer pc Using Lost Door 4.0

 What the things you Need?
1. A Free Account in www.no-ip.com and there you need a free Host.
2. Lost Door Tool
3. May be you need for Microsft Frame Work ( Must Install it Mostly Hacking tools did not work
     without it
4. A Cup of Tea or Coffe or a glass of Milk.. i also drink Milk..:)

so LEarn Tutorial Step by Step.

• Download Lost Door ( Password for Extracting is umerrock )
• Extract the files in your HArd Drive and Accept it

• After it is open, right click on the window and click on create server

• Now enter your IP address and DNS here. Leave the rest of the field as it is.

• Now click on the ‘Options’  tab and choose the options as you want. To activate an offline keylogger is a good practice.

• Now go to ‘Advanced’ Tab. There will options related to spreading. This will be used in case you have more than 1 victim.

• Now just go to the ‘Create’ tab and click on create server. Your server is ready for use now and now send it to the victim.

 After Create SErver SEnd this File to your Victim, you can upload your server on mediafire and share it with friends and enjoy using her pc..:)

Read More

What is a RAT (Remote Administrator Tool)

A RAT is also a shortcut called Remote Administrator Tool. It is mostly used for malicious purposes, such as controlling PC’s, stealing victims data, deleting or editing some files. You can only infect someone by sending him file called Server and they need to click it.

What can RAT do?

With a RAT, you can make the party download files, view their desktop/webcam, and more. Here is a list of basic features of a popular RAT:

* Manage files
* Control web browser (Change homepage, open site etc.)
* Get system information (OS Version, AV name, Ram Memory, Computer name etc.)
* Get passwords, credit card numbers or private data etc.
* View and remote control desktop
* Record camera & sound
* Control mouse
* Delete, rename, download, upload or move files

Are RATs Illegal?

Some RATs are legal, and some are not. Legal are the one without backdoor left, and they have ability to close connection anytime. Illegal are used for hacking and they can steal data (Credit Cards, Passwords, private data etc.).

Here is a list of some Legal and Illegal RATs:

Legal:

* TeamViewer – Access any remote computer via Internet just like sitting in front of it – even through firewalls.
* UltraVNC – Remote support software for on demand remote computer support. VNC.Specializing in Remote Computer Support, goto my pc, goto assist, Remote Maintenance
* Ammyy Admin – Ammyy Admin is a highly reliable and very friendly tool for remote computer access. You can provide remote assistance, remote administration or remote
* Mikogo – Mikogo is an Online Meeting, Web Conferencing & Remote Support tool where you can share your screen with 10 participants in real-time over the Web.

Illegal:

* Spy-Net
* Cerberus Rat
* CyberGate Rat
* SubSeven
* Turkojan
* ProRat
   Darkcomet

How do I use these RATs?

For the legal RATs, for example, TeamViewer, give the other party your ID and password (the one who is getting viewed gives the other the information). The other connection then puts the ID. You then have many options to choose from, which are self explanatory (once connected).

For the illegal Rats, you need to portforward it to listen onto a port. You then need to build a server, spread it to others, they run your program, and they’re infected.

How do I port forward?

Port forwarding is easy and important for an illegal RAT. You need open port because RAT connects through open port and bypass firewall. Open your web browser and write your IP and connect to your rooter (write Username: Admin & Password: Admin), open port forward page and write port you want and your IP. Well that’s all you need to do and now you got open port.

How do I control server?

Once installed, RAT server can be controlled via RAT client. From IP list box you choose PC and connect.

Where and how do I spread?

There are few different ways to spread your server. You can spread on warez websites, P2P file sharing websites (uTorrent, Pirate bay etc.), YouTube, etc. Some people use custom made Auto-Spreaders programs to spread their server.

What’s reverse Connection?

A reverse connection is usually used to bypass firewall restrictions on open ports. The most common way a reverse connection is used is to bypass firewall and Router security restrictions.

Whats Direct Connection?

A direct-connect RAT is a simple setup where the client connects to a single or multiple servers directly. Stable servers are multi-threaded, allowing for multiple clients to be connected, along with increased reliability.

FAQs (Frequently Asked Questions) about RATs

Q – Why my RAT server is detected by the most anti-virus software?
A – If you want to make your server FUD (Fully UnDetectable), you will need crypter. Also, you can hex edit your server, but be careful some servers can crash after hex editing.

Q – Can I get infected by using a RAT?
A – If the programmer that gives a download link to the RAT backdoors it (very possible), then yes. By simply downloading a file, you can be infected and vulnerable to many things. By using a legal rat, chances are you won’t be infected.

Q – How do I remove server if I infect myself?
A – When you infect yourself, first what you going to do is to connect to your PC. Some RATs have function to uninstall servers, well you click that and you uninstall it. There is another way, download MalwareBytes’ Anti-Malware and scan whole computer for trojans.

Q – Can I get traced when I rat somebody?
A – Yes and no. Depends on victim, it is really hard to remove infection or even trace a hacker. There are tools like WireShark, but it’s really hard to trace, because PC usually got over 300 connections. So don’t worry.

Read More

Cybergate RAT - Download (Hack Computer)

Cybergate RAT - Download (Hack Computer)

What is CyberGate:

CyberGate is a powerful, fully configurable and stable Remote Administration Tool coded in Delphi that is continuously getting developed by our experienced team.

What it can do :

CyberGate was built to be a tool for various possible applications, ranging from assisting Users with routine maintenance tasks, to remotely monitoring your Children, captures regular user activities and maintain a backup of your typed data automatically. It can also be used as a monitoring device for detecting unauthorized access.
CyberGate achieves this though it's abundant array of features. A few of which are illustrated below :

[+] Automatically map ports if your router supports uPnP;

[+] Multi-Threaded : allowing for multiple clients to be connected, along with increased reliability.

[+] Reverse Connection : Some of the listed advantages of a reverse connection -
# Outgoing connections generally are less treating, and are less likely to be detected or blocked by a firewall, such as a router.
# Since the remote's computer is connecting to the remote administrator, one does not need to know the remote's IP address in order to connect.

# It is much easier to keep track of the computers the RAT is installed on, since they are all "calling home" by connecting to the remote administrator.

[+] User Friendly GUI : The neat and simple GUI of CyberGate make this tool very easy to use and the simplest way to achieve yours goals.

[+] Stealth : The various features of the server installation makes the server extremely customizable accord to each user's needs and requirements.

[+] Keylogger : This tool can be used to find out what is happening on your computer while you are away, maintain a backup of your typed data.

[+] Password recovery : It can be used to recover some of passwords that your forgot long time ago.

[+] Tasks: CyberGate is able to create either tasks for the Client to perform on a specific time after being started or an individual remote whenever it connects back to CyberGate.

[+] Connections tab: You can monitor all the connections and client performance from a connection log that will register actions and time /date for those actions.

Download CyberGate

Read More

How to hack a computer with Nmap and Metasploit

I have written different hacking articles about Nmap and Metasploit. Now I am writing this article to teach how to hack a computer using these two great tools.

Just got to http://www.metasploit.com/ and download the Latest Framework (not the mini version).

Now open the metasploit console. And type the following commands:

1: db_create (this will create database needed for this attack)

2: TYPE nmap -sT –sV XXX.XXX.XXX.XXX( X be the IP address of victim)

Now give it time to scan and when it is complete type following command.

3: db_autopwn -p -t –e

This would start the penetration test and great thing about this is that it does not need any manual configuration. Every thing will be done automatically and if the test is successful a shell will be created.

Read More

How to Hack a computer using Metasploit

Metasploit is one of the greatest Hacking tools ever. It makes the hacking easy for the Script Kiddies (new hackers). But Question comes How to use it to hack a computer?

Metasploit Framework comes in command-line as well as GUI version. This article will deal with the command-line version. Followings are the basic commands of Metasploit that you should Learn by Heart.

1: help (show the commands.)

2: show info XXXX (to show the information on specified XXXX value, that is can be exploit or payload)

3: show options ( to show the options for a exploit and payload. Like RHOST, LHOST)

4: show exploits/payloads (to get a list of exploits/payloads)

5: use XXXX (to select the name of the exploit.)

6: set XXXX (to set the value of RHOST, LHOST or payload)

7: exploit (to launch a exploit on targeted machine.)

Note: To hack a computer using Metasploit first you should have the enough information of the target ­­including

1: IP address

2: Open Ports

3: services running

4: Version of software running

All of these need a little work. A famous tool to do all of these is NMAP on which I have written some articles.

Now the first step is choosing a right exploit for the vulnerabilities in the machine. To determine the exploit for the attack you need all the things noted above. For example the computer is running a SMTP server on Port 25 and there is a exploit on it than you hack that computer.

To choose an exploit following command is there:

Use [exploits address . e.g. Exploit/windows/smtp/xxx. ]

Now you need a payload (payload is a piece of program that will be executed if vulnerability is exploited). To get a list of all the payloads available for the exploit Just type following command.

Show payloads

Now choose an appropriate a payload from it. The only thing left is to set the fields for the attack. List of Most Probable fields to be set is given bellow.

RHOST = The IP address of the computer to be attacked.

RPORT = The Port of the service to exploited (it set by default)

LHOST = The IP address of your computer (it set by default)

LPORT = The default port of your Metasploit program (it set by default)

Now the Last step is to type the following command and Launch attack to the computer.

exploit

After typing this command the attack will be launched and if vulnerability is successfully exploited the payload will be executed and a shell (you can take it as command prompt) will be launched which will allow you to do anything with the computer that you have attacked.

DownLOad Metasploit FrameWork

Read More

Difference Between a DoS and a DDoS Attack

DoS = Denial Of Service

DDoS = Distributed Denial Of Service

What is the difference between the two?

Whilst DoS and DDoS sound remarkably similar there are in fact differences between the two -

DoS

A DoS Attack is a Denial of Service attack.

This means that one computer and one internet connection is used to flood a server with packets (TCP / UDP).

The point of such a denial of service attack is to overload the targeted server’s bandwidth and other resources.

This will make the server inaccessible to others, thereby blocking the website or whatever else is hosted there.

DDoS

A DDoS Attack is a Distributed Denial of Service Attack.

In most respects it is similar to a DoS attack but the results are much, much different.

Instead of one computer and one internet connection the DDoS attack utilises many computers and many connections.

The computers behind such an attack are often distributed around the whole world and will be part of what is known as a botnet.

The main difference between a DDoS attack vs a DoS attack, therefore, is that the target server will be overload by hundreds or even thousands of requests in the case of the former as opposed to just one attacker in the case of the latter.

Therefore it is much, much harder for a server to withstand a DDoS attack as opposed to the simpler DoS incursion.

Read More

Spynet 2.7 Download - Ghost Edition

Spynet 2.7 Download - Ghost Edition

New features include:
- Added optional connection limit.
- Increased connection stability. Spy-Net is now as stable as SS-Rat.
- Increased speed in filemanager list files and list drives.
- Autostart on most features nw
- Password retrieval has been improved.

Features and specs:
- server around 280 kb, depending on if icon is selected, rootkit, upx compressed, etc
- windows xp, vista and 7 compatible;
- DNS Updater (for now working with No-IP. developing dyndns updater atm)
- File Manger with a load full of options like FTP upload, set attributes to files, preview for images, etc etc etc;
- Windows List;
- Process List;
- Device List;
- Service List;
- Registry Editor;
- Installed Programs;
- Active Ports List;
- Remote Desktop;
- Webcam capture;
- Audio Capture;
- Password Recovery Tool (with direct download to client or FTP logs);
- Password Grabber;
- Socks 4/5 proxy;
- HTTP Proxy;
- Open Webpage;
- Download and Execute;
- Send local files and run hidden or normally;
- Remote Chat Client;
- DOS Prompt;
- Run cmd;
- Clipboard Grabber;
- Search for remote files and search on Password Recovery Tool;
- Access to download folder, remote desktop screen shots and web capture from menu.
- Encrypted traffic between Client and server;
- a few extra options (restart, lock buttons and stuff....) and all the options related to server (uninstall, rename, etc etc etc);
- add a new option for injection - wait for first browser to open. not the default but the first to start. seems useful in some cases.
- Rootkit in beta stage and being developed. It will hide process name and startup keys that have SPY_NET_RAT as name. Tested under XP and working, being developed and tested on other OS's;
- Connections Limit selector;
- Binder,
- Columns selector (u can choose which columns u wanna see details from in the client. ex: u can hide RAM info view or Ports info view or any other using right click on top of the columns);
- Ability to choose either server is installed or not in remote computer.

NOTICE:you cant update it spynet 2.6 to 2.7 its not compatible

Download SpyNet

Read More

Hack Computer/pc using ip Adress

Literally, hacking is accessing something or somebody in internet without their permission or interest. While, speaking in summary, hacking is very easy job, it is like instead of using front door, finding the hidden door of a house and hijacking the precious things. Among all the hacking, hacking via IP address is one of the most common yet powerful beginning.
You may want to hack the website and put your advertisement there or grab some database information In this type of hacking, you are playing with the web server’s computer instead of the administrator’s computer. Because, www.website.com is hosted in separate web server rather than personal computer.
Another can be accessing your friend’s computer from your home. Again this is IP based and this is possible only when your friend’s computer is online. If it is off or not connected to internet then remote IP hacking is totally impossible.
Well, both of the hacking has the same process. Let’s summarize what we must do.

1. Confirm the website or a computer you want to hack.
2. Find or trace their IP address.
3. Make sure that IP address is online
4. Scan for open ports
5. Check for venerable ports
6. access through the port
7. Brute-force username and password

Now let me describe in brief in merely basic steps that a child can understand it.

First, getting the IP address of victim.

To get the IP address of the victim website, ping for it in command prompt.

For example,

ping www.google.com

will fetch the IP address of Google.com

This is how we can get the IP address of the victims website.
How about your friend’s PC? You can’t do www.yourfirend’sname.com, can you? Finding your friend’s IP address is little tough job, and tougher it is if he has dynamic IP address that keeps changing.
One of the widely used method to detect IP address of your friend is by chatting with him.
You might find this article helpful

• How to get the IP (Find Ip online by Email)

Now you got the IP address right? Is it online? To know the online status just ping the IP address, if it is online it will reply.
If the IP address is online, scan for the open ports. Open ports are like closed door without locks, you can go inside and outside easily.
Use Advanced Port Scanner to scan all open and venerable ports.

Now you’ve IP address and open port address of the victim, you can now use telnet to try to access them. Make sure that you’ve telnet enabled in your computer or install it from Control panel > Add remove programs > add windows components.
Now open command prompt and use telnet command to access to the IP address. Use following syntax for connection.
telnet [IP address] [Port]



You’ll be asked to input login information.

If you can guess the informations easily then it’s OK. Or you can use some brute-forcing tools like this one.
In this way you’ll able to hack remove computer using only IP address

Read More

DarkComet-Rat v3.0 (Professional 2010)

DarkComet 3.0 List improvement
------------------------------
By DarkCoderSc
- 09/10/2010 : RC4 traffic encryption done , its encrypt all plain text and data flux with a RC4 encryption 256 bit , all your private data are now totally secured and DarkComet is impossible to flood / exploit .
- 09/10/2010 : Dynamic RC4 256 bit Key added when you choose a password on DarkComet , thats mean if you want to be secured at 200% when you choose a password in server it will bind the actual RC4 key with your password then without the correct client password the data wont be correctly decrypted then nothing will work without your password.
- 09/10/2010 : Now edit server settings are totally encrypted in RC4 256 bit too then its no more possible to reverse and read your personnal settings , again you are totally secured now ;)
- 10/10/2010 : New column added in connection list (SIN) , now you can see the RAM usage/Total RAM and Free RAM.
- 10/10/2010 : New column added in connection list (SIN) , now you can see the country code/country localisation(geo) and the default system langage
- 10/10/2010 : New column added in connection list (SIN) , now you can see the first execution data/time of the server if it just been executed and not installed it display the current date/time.
- 10/10/2010 : Now you can choose if you want to display the default language flag or the geo ip flag
- 10/10/2010 : In OS collumn windows installed drive added (its where windows was installed)
- 12/10/2010 : Clipboard manager have been recoded , now you can resize the textbox and listview for a better confort
- 12/10/2010 : Two functions added in Clipboard manager , get the remote clipboard text in your clipboard , and send your clipboard text to the remote clipboard.
- 12/10/2010 : Process Manager got now a real better compatibility on 64 bit OS, now it list all process
- 12/10/2010 : Process Manager list the process 3x faster.
- 12/10/2010 : If you use a password for protecting connection it will be display in tray icons with a locker to remind you !
- 16/10/2010 : New toast style made , now you it display more information and have a better design.
- 16/10/2010 : Clipboard copy problem fixed in password manager , also the whole system is more stable

Download

Read More