| Revision as of 06:44, 8 March 2014 editBgwhite (talk | contribs)Extended confirmed users547,151 edits Do general fixes and cleanup. - using AWB (9970)← Previous edit | Revision as of 16:38, 8 March 2014 edit undoTutelary (talk | contribs)Extended confirmed users, Pending changes reviewers, Rollbackers17,196 editsm →Notable RAT software and trojans: Fixed linkNext edit → | ||
| Line 46: | Line 46: | ||
| * ] | * ] | ||
| * Bandook RAT | * Bandook RAT | ||
| * ] | * ] | ||
| * ]<ref>{{Cite web|url=http://www.codinghorror.com/blog/2007/03/code-access-security-and-bitfrost.html|title=Code Access Security and bifrost|publisher=Coding hooro.com Mar 20, 2007|accessdate=5 February 2011}}</ref> | * ]<ref>{{Cite web|url=http://www.codinghorror.com/blog/2007/03/code-access-security-and-bitfrost.html|title=Code Access Security and bifrost|publisher=Coding hooro.com Mar 20, 2007|accessdate=5 February 2011}}</ref> | ||
| * Darkcomet<ref>{{cite web|last=Denbow|first=Shawn|title=pest control: taming the rats|url=http://www.matasano.com/research/PEST-CONTROL.pdf|accessdate=5 March 2014}}</ref><ref>{{cite web|last=Aylward|first=Laura|title=MALWARE ANALYSIS - DARK COMET RAT|url=http://contextis.com/research/blog/malware-analysis-dark-comet-rat/|publisher=Context|accessdate=5 March 2014}}</ref> | * Darkcomet<ref>{{cite web|last=Denbow|first=Shawn|title=pest control: taming the rats|url=http://www.matasano.com/research/PEST-CONTROL.pdf|accessdate=5 March 2014}}</ref><ref>{{cite web|last=Aylward|first=Laura|title=MALWARE ANALYSIS - DARK COMET RAT|url=http://contextis.com/research/blog/malware-analysis-dark-comet-rat/|publisher=Context|accessdate=5 March 2014}}</ref> | ||
Revision as of 16:38, 8 March 2014
 | This article's tone or style may not reflect the encyclopedic tone used on Misplaced Pages. See Misplaced Pages's guide to writing better articles for suggestions. (January 2012) (Learn how and when to remove this message) |
A remote access tool (a RAT) is a piece of software that allows a remote "operator" to control a system as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "RAT" software is usually associated with criminal or malicious activity. Malicious RAT software is typically installed without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its operation from the victim and from security software.
The operator controls the RAT through a network connection. Such tools provide an operator the following capabilities:
- Screen/camera capture or image control
- File management (download/upload/execute/etc.)
- Shell control (from command prompt)
- Computer control (power off/on/log off if remote feature is supported)
- Registry management (query/add/delete/modify)
- Hardware Destroyer (overclocker)
- Other software product-specific functions
Its primary function is for one computer operator to gain access to remote PCs. One computer will run the "client" software application, while the other computer(s) operate as the "host(s)".
RAT trojan horses
Many trojans and backdoors now have remote administration capabilities allowing an individual to control the victim's computer. Many times, a file called the server must be opened on the victim's computer before the trojan can have access to it. These are generally sent through email, P2P file sharing software, and in internet downloads. They are usually disguised as a legitimate program or file. Many server files will display a fake error message when opened, to make it seem like it didn't open. Some will also kill antivirus and firewall software. RAT trojans can generally do the following:
- Block mouse and keyboard
- Change your desktop wallpaper
- Download, upload, delete, and rename files
- Destroy hardware by overclocking
- Drop viruses and worms
- Edit Registry
- Use your internet to perform denial of service attacks (DoS)
- Format drives
- Grab passwords, credit card numbers
- Hijack homepage
- Hide desktop icons, taskbar and files
- Install software
- Log keystrokes, keystroke capture software
- Open CD-ROM tray
- Overload the RAM/ROM drive
- Print text
- Play sounds
- Control mouse or keyboard
- Record sound with a connected microphone
- Record video with a connected web cam
- Show fake errors
- Shutdown, restart, log-off, shut down monitor
- Steal passwords
- View screen
- View, kill, and start tasks in task manager
A well designed RAT will allow the operator the ability to do anything that they could do with physical access to the machine. Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on April Fool's Day or a holiday. Prank RATS are generally not harmful, and won't log keystrokes or store information about the system on the computer. They usually do disruptive things like flip the screen upside-down, open the CD-ROM tray, and swap mouse buttons.
Notable RAT software and trojans
- Back Orifice
- Bandook RAT
- Beast Trojan
- Bifrost
- Darkcomet
- LANfiltrator
- Optix Pro
- ProRat
- Sub Seven (Sub7)
- Y3K Remote Administration Tool
- Xi Rat Reverse
See also
References
- "Remote Server Administration Tools for Windows 7". Microsoft Technet June 4, 2009. Retrieved 4 February 2011.,
- "Danger: Remote Access Trojans". Microsoft technet September 2002. Retrieved 5 February 2011.
- "Understanding the Windows NT Remote Access Service". Microsoft technet date undisclosed. Retrieved 5 February 2011.
- "Netsh commands for remote access (ras)". Microsoft technet January 21, 2005. Retrieved 5 February 2011.
- "RAS Registry Modification Allowed Without Administrative Rights". Microsoft technet date undisclosed. Retrieved 5 February 2011.
- "Computer RATS - Protecting Your Self". HowTheyHack July 2013. Retrieved 17 July 2013.
- "Code Access Security and bifrost". Coding hooro.com Mar 20, 2007. Retrieved 5 February 2011.
- Denbow, Shawn. "pest control: taming the rats" (PDF). Retrieved 5 March 2014.
- Aylward, Laura. "MALWARE ANALYSIS - DARK COMET RAT". Context. Retrieved 5 March 2014.
- "Backdoor.Lanfiltrator". Symantec date undisclosed. Retrieved 5 February 2011.
- "BD Y3K RAT 1.1". Symantec date undisclosed. Retrieved 5 February 2011.