» RAT sources

Ri0t bot source code.

carrumba — Tue, 30 Nov 2010 13:50:02 +0000


RAT name	ri0t bot

Author	Unknown

Written in	C

Description	ri0t bot is a quite complete implementation of a bot. It is controlled via IRC, it extracts CD keys and serial numbers of many different applications/games, it sniffs key strokes, network traffic, extracts account information from installed applications, avoids updates of installed anti virus software and it contains spreading functions via P2P networks and USB storage devices. All together it’s a nice source and worth a reading if you want to get an impression how a bot is constructed.

Questions	Do you have a question about this RAT/bot/worm? At the bottom of this post you find the box where you can type and send your message.

Downloads	Source

Trj/Casper.A sources.

carrumba — Mon, 15 Feb 2010 07:12:30 +0000


Name	Trj.Casper

Type	RAT

Author	Unknown

Written in	C

Description	This sourcecode dates back to 2004. It is quite old and its functionality is rather limited. The intresting part in this source code is the injection section which represents the biggest part of it. It contains an injection function based on the CreateRemoteThread call and all required functions to make it completely run in a remote process. You can use it as a basic example and extend it with your own functionality.

Questions	Do you have a question about this RAT/bot/worm? At the bottom of this post you find the box where you can type and send your message.

Downloads	Source

FBI RAT source code.

carrumba — Sun, 24 Jan 2010 14:30:53 +0000


Name	FBI RAT

Type	RAT

Author	Albinoskunk

Written in	C

Description	After calling for your submissions this is the first RAT source that reached me. It was coded by Albinoskunk. The source is based on Aryan v0.5, it was improved at some places and contains all relevant components of a RAT, client, server, GUI and what I consider as the most interesting part in this RAT is the process injection function. Here its main characteristics : File Manager System Manager Keylogger Screen capture Webcam Packet Sniffer!

Questions	Do you have a question about this RAT/bot/worm? At the bottom of this post you find the box where you can type and send your message.

Downloads	Source

Screenshot

Realmbot

carrumba — Fri, 04 Dec 2009 19:21:08 +0000


Name	Realmbot

Type	RAT, Bot

Author	Unknown

Written in	C/C++

Description	This is a variant of the REalmbot created by Lindem in 2006. Also here many of the typical bot functions were implemented. Services control, user control, process control, key logger (in a rather unelegant way), an FTP and HTTP server, port redirection, etc. The structure is a little chaotic. Reading through the code is rather cumbersome.

Questions	Do you have a question about this RAT/bot/worm? At the bottom of this post you find the box where you can type and send your message.

Downloads	Source

Win32/Rbot source code.

carrumba — Fri, 16 Oct 2009 21:13:31 +0000


Name	Win32/Rbot

Malware type	RAT, Worm

Author	Unknown

Written in	C

Description	Rbot is an IRC controlled backdoor (or “bot”) that can be used to gain unauthorized access to a victim’s machine. It can also exhibit worm-like functionality by exploiting weak passwords on administrative shares and by exploiting many different software vulnerabilities, as well as backdoors created by other malware. There are many variants of Rbot, and more are discovered regularly. Rbot is highly configurable, and is being very actively developed, however the core functionality is quite consistent between variants. Most instances of Rbot are compressed and/or encrypted with one or more run-time executable packers. Rbot variants are able to spread in a number of different ways. Propagation is launched manually through backdoor control, rather than happening automatically. Not all variants support all propagation mechanisms. Each spreading method begins with scanning for target machines. The worm can generate random values for all or part of each IP address it targets. Each attack vector is associated with a particular TCP port. Via Network Shares (TCP ports 139 and 445) Via LSASS buffer overflow vuln. (TCP port 445) Via WebDav vuln. (TCP port 80) Via RPC msgbuffer overflow vuln. (TCP ports 135, 445, 1025) Via RPCSS DCOM msg buffer overflow vuln. (TCP port 135) Via Exploiting weak passwords on MS SQL servers Via UPnP NOTIFY buffer overflow (TCP port 5000) … Rbot’s main function is to act as an IRC controlled backdoor. It attempts to connect to a predefined IRC server and join a specific channel so that the victim’s computer can be controlled. The IRC server, port number, channel and password differ with each variant. Rbot also listens on TCP port 113 to provide ident services, which are required by some IRC servers. Once the victim’s computer is under control, the overseer is able to instruct Win32.Rbot to attempt to perform malicious operations such as spreading via administrative shares with weak passwords or the DCOM RPC exploit.

Questions	Do you have a question about this RAT/bot/worm? At the bottom of this post you find the box where you can type and send your message.

Downloads	Source

Sources	www.ca.com

PsyRAT 2 source code.

carrumba — Tue, 13 Oct 2009 13:24:28 +0000


RAT name	PsyRAT 2

Author	Psyphen

Written in	C

Description	Many of the typical RAT functions were implemented. Simple and straightforward. As the author stated the code is not very structured but LOC is low and you will find the paragraphs you’re intrested in. It contains server and client but unfortunately the stub is compiled and comes without source code.

Questions	Do you have a question about this RAT/bot/worm? At the bottom of this post you find the box where you can type and send your message.

Downloads	Source