/EducationalRAT

From @securesean Malware101 course for Red Teamers at BSides 2018

Primary LanguageC#

RattyMcRatFace

This is a Proof of Concept of a C# RAT (Remote Access Trojan) made by Sean Pierce (@secure_sean) for the How to Write Malware 101 class to demonstrate to defenders the ease, speed, development goals, and characteristics of common malware. Download the class development VM here: rebrand.ly/writemalware

Easy for an Attacker to Change:

  • Hash
  • PDB String
  • Compile Time
  • File Details

Less Easy for an Attacker to Change:

  • File Size
  • Domains

Harder for an Attacker to Change:

  • Features
  • Functionality
  • Network Traffic
  • ImpHash

When hunting for malware Search for:

  • Small Executable files - scripts, stagers, downloaders, etc.
  • Freshly compiled and installed executables
  • Common persistence, malicious/administration functionality