rat — Remote-Access Trojan
A remote-access trojan (RAT) is malware that establishes persistent, interactive control over a compromised host, giving the operator the same capabilities as a legitimate remote-administration tool — but without the victim's consent.
Defining Behaviors
- Reverse or bind TCP/UDP/socket connection to an attacker-controlled C2 server
- Real-time screen viewing / remote desktop
- Keylogging and clipboard capture
- Webcam and microphone capture
- File upload/download/execution
- Registry and process manipulation
- Credential harvesting from browsers, mail clients, and wallets
- Lateral-movement facilitation (e.g., SOCKS5 proxy, port forwarding)
Build Stacks Commonly Observed
- Delphi VCL: darkcomet, remcos, older gh0st variants
- .NET Framework: quasar, asyncrat, nanocore, xenorat
- Go: dolphin, zenconnekt
- C/C++ (MSVC / MinGW): gh0st (modern), meterpreter
- Rust: dolphin (polymorphic variants)
C2 Protocol Patterns
| Pattern | Families | Notes |
|---|---|---|
| Raw TCP + plaintext tokens | darkcomet, remcos | Builder-configurable host/port |
| Raw TCP + MessagePack | asyncrat, quasar | AES-256-HMAC + TLS wrapper |
| Raw TCP + protobuf-net | quasar, asyncrat | protobuf-net serialization |
| WebSocket-over-TLS | dolphin, zenconnekt | msgpack or JSON framing |
| HTTP/HTTPS beacon | meterpreter, nanocore | Staged or stageless |
| FTP exfiltration | darkcomet, remcos, agenttesla | Hardcoded credentials |
| Telegram Bot API | maskgramstealer | No dedicated infra required |
Detection Focus
- Unusual parent-child process trees (e.g.,
explorer.exe→ child with network socket) - Persistence via registry Run keys, services, or scheduled tasks
- Named mutexes / events with static patterns (e.g.,
TMPMUTEX,DC2_USERS) - Imports of
wsock32.dll+CreateRemoteThread+WriteProcessMemoryin GUI binaries