How To Setup A Rat ---
By:bozotheclown138
Well first things first you need a RAT now i personally recommend Poison Ivy, Bifrost, or Cerberus seeing as those in my opinion those are the best.
Where to get them? well poison ivy has its own website so just use google to find that, as the other ones the cerberus website isnt finished yet and bifrost doesnt have one. So you have to find them on your own. HH is where cerberus was made and they have clean versions of Bifrost so try there if you want. ( there are also binders and crypters there too)
newbie tip!
Once you have your RAT make sure before downloading you disable any antivirus you have because it will detect this as a threat, it is just due to the nature of it that it will be detected. Also be sure to add your file to your antiviruses exclusion list.
Poison Ivy
When you first open up Poison Ivy you will want to go
to file and create new client, the settings that are
already there are fine.
Now go to create new server
and name it whatever you want. Now i recommend using a
No-IP account or a DYNDNS account and at the DNS/PORT
replace the 127.0.0.1 with your host you created, but
do not remove the "
0," you require that and then test the connection if you want.
Now click next.
Now on this screen have everything
checked. For the HKLM/Run name, choose a name that
doesn't sound suspicious. Then generate a random
ActiveX key. Now copy the file to the system folder
and once again name it something unsuspicious. Now
make sure once again all the checkboxes on this screen
are checked and move on.
Now I'd leave the process mutex at what it is. Inject
the server into the default browser and have
persistence. For injecting into a running process I
would choose winlogon.exe or iexplore.exe Enable the
keylogger and for the format leave it as it is. Now move on.
Click the icon and choose an icon of your choice, then
press generate followed by ok and your set! (you can
add plugins from their website if you'd like)
Bifrost
Now choose the builder option and once again setup a
No-IP or DYNDNS account if you have not and remove
127.0.0.1 and replace it with the host you have
created. (Don't use a password) Now go to
installation.
Change the file name when installed to what you would
like, same with the directory to install to, but i
would change it to the system directory personally.
Check Autostart at reboot and generate a random key.
Leave the mutex name at what it is, but change the
registry key to a name of your choice. Include the
extension pack and the offline keylogger with both
exclusion options checked. Try to inject the server
into either iexplore.exe or winlogon.exe Assigned name
doesn't matter and check persistant server. Now move to stealth.
Choose cautious mode and I would delay the connection
for 5min. (So their firewall won't pick up on it
instantly) And then check Everything else... hidden,
melt, older date, hide process, and kernel level
unhooking. Now move to miscellaneous.
Don't use TOR unless you have the plugin and even then
it's not necessary. Choose build and there's your
server! (also once you have clients and you choose the
update function sometimes you may lose some people)
Cerberus
Now in Cerberus choose options first and go to extras
and once again make sure you have a No-IP or DYNDNS
account setup and fill in the inforation required to automatically update it.
Alright now click New. Remove 127.0.01 and put in your host you have made with your No-IP or DYNDNS account. That's all you need to do in
that section move to server installation.
Alright make sure you install the server haha and use system and
rename it to what you would like. And probably you
will want to keep it an application, but you can
rename server if you want. Now move on to boot methods.
Now check all of them except Explorer Run (You can
choose this, but I find it to cause instability) Now
rename the registry keys to what you would like and
generate an active setup key. Now i personally would
skip Add file and just use binder for that, and for
Anti Debugging just check all of the boxes.
For Misc. Options check Keylogger and check exclude
backspace and leave the filename as it is.
For stealth change the date, hide the files, but I do not
recommend delete on Execution. Make it persistant and
inject it into iexplore.exe or winlogon.exe and rename
the mutex to something you would like.
Display a message if you want, but not necessary.
For the blacklist just name any antiviruses processes
or services you can find and put them in here. (Use
google to find the names of the processes and
services) Now go to create server.
Change the save file as name to what you would like
and uncheck run server in visible mode. You can
compact it if you would like and include the plugin. I
would use an icon and find an icon you'd like and put
it into the icon directory under cerberus to choose
it. Then click create server and there you go! (Once
again when you update you may lose some of your
clients)
Crypters
Now the next thing you will need is a crypter. Well you know once you find one youll want to make sure it has EOF support otherwise it wont work. Then try crypting your server and scan it on novirusthanks.org now its up to you how undetected you want it. so keep trying new crypters until you find one you like. once you have it ready try it on yourself. just open the server and see if you appear on your RAT. if you do this is good it means the server is stable, and then right click and choose uninstall server. (If you don't show up you need another crypter or change your settings for your server, and make sure your connected to your no-ip or dyndns account too)
Binders
Now you'll want to bind it with a folder just get a binder and another program you want to open up with the server. (it's pretty self explanatory once you open up a binder so no need for an indepth look at that) then test it again on your self and upload it to novirusthanks again and if its detected more than it was before try crypting your file after you bind it instead of before.
Then basically your all setup and i wont go through how to infect lots of people because that would be bad
but just send it to who you want it to go to and there you go.-----------
I got no problems with the ethics - because he left out the dirty (but known) tactics to deliver the RAT.
