What is RAT (Remote Access Trojan)?
A Remote Access Trojan (RAT) is a type of malware that allows covert surveillance, a backdoor for administrative control and unfettered and unauthorized remote access to a victim’s machine.
The RAT is extremely dangerous because it enables intruders to get remote control of the compromised computer.
Once the host system is compromised, the intruder may use it to distribute RATs to other vulnerable computers and establish a botnet.
Because a RAT enables administrative control, it makes it possible for the intruder to do just about anything on the targeted computer, including:
- Monitoring user behavior through keyloggers or other spyware.
- Accessing confidential information, such as credit card and social security numbers.
- Activating a system’s webcam and recording video.
- Taking screenshots.
- Distributing viruses and other malware.
- Formatting drives.
- Deleting, downloading or altering files and file systems.
What are the most common types of RAT?
• Back Orifice
• SubSeven
• ProRat
• Turkojan
• Poison-Ivy
• Saefko
• CrossRAT
• Beast Trojan
• Blackshades
• Mirage
• DarkComet
• NetBus
• Nuclear RAT
How is the RAT installed on my computer?
RAT is often like other malware infection vectors. Hackers use various techniques to install a RAT on your computer. These techniques and methods are listed below:
- Users can be tricked to download malicious packages
- Users can be lured into visiting suspicious web links
- Crafted email attachments are sent to the target users
- RAT is delivered using files downloaded through torrents
Threat actors can install RATs either by gaining temporary physical access or via social engineering attacks.
How to detect RATs?
Detecting a Remote Access Trojan is a difficult task because in most cases, they do not show up in the list of running tasks or programs on your computer. Moreover, your system will not be slowed. However, your internet speed will slow down as RAT uses your bandwidth to work. A RAT can infect your computer for several years if it goes unnoticed.
To get out of the RAT nightmare, using malware detection tools and antivirus scans can be helpful.
How can a RAT be avoided?
There are several tools, techniques and best practices that can be used to avoid a RAT attack. Below is a detailed list of them:
- Do not download files from untrusted sources such as pornography sites or freeware software
- Always avoid opening email attachments from strangers or people you don’t know
- Do not download games through malicious websites
- Install antivirus software and keep it patched and up to date
- Always keep your OS, web browsers and applications up-to-date and apply patches to all of them
- You should also avoid downloading torrent files if they are from unreliable sources
- Always lock public computers when they are not in use, and be cautious of telephone calls or emails asking you to install an application
- It is sometimes difficult to avoid a RAT because the attackers use a binder to link a RAT with legitimate executable programs, which hampers the detector from finding it. Though RATs don’t show up in running processes, using a task manager to look for unfamiliar or unknown processes is a good practice. If there are any strange files running in your task manager, then quickly remove them. If you do not find any strange processes, then search for it on Google to get the answer
- Sometimes, a RAT is added to Windows startup directories and registry entries so that it can start automatic execution every time you turn on your system.
- Another good idea for removing suspicious applications from your computer is to use the “Add or Remove Program” option located in your control panel. If you notice any odd program on your computer, just uninstall it.
- Since a RAT uses the bandwidth of your internet connection, it will ultimately slow down your internet speed. Therefore, poor internet speed may be an indication of RAT malware. If this is the case, quickly disconnect your internet. Doing so will prevent attackers from taking control of your PC, because RAT only works when the internet connection is active. After disconnecting the internet, you need to use a malware program such as Spy Hunter or Malwarebytes to exterminate a RAT.
10 Best RAT Software Detection Tools
If you like to look at digital attack maps, have a look at this page on Secure Idées which points to sites such as map.httpcs.com.
Source: dnsstuff, Fakhar Imam
The vulnerability used in this attack (code named EternalBlue) was among those leaked by the Shadow Brokers group. The vulnerability was exploited to drop a file on the vulnerable system, which would then be executed as a service. This would then drop the actual ransomware file onto the affected system, encrypting files with the .WNCRY extension. (A separate component file for displaying the ransom note would also be dropped.) Files with a total of 176 extensions, including those commonly used by Microsoft Office, databases, file archives, multimedia files, and various programming languages.
If WannaCry/Wcry entered an organization’s network, it could spread within it very rapidly. Any machine or network that has exposed port 445 to the internet is at risk as well. EternalBlue exploit works over the Internet without requiring any user interaction.
lakkireddymadhu 