7 - Malware
Module 07 - Malware
Identify malware entry point address
Detect it easy
Execute Detect it easy client tool
Upload malware executable
Click to File info
See entry point address
or using PEiD or PE Explorer tools
Retrieve file connecting to RAT installed into victim machine
ProRat
Execute ProRat
Set victim IP and relative port 5110
Click to connect and search files.
Theef
Execute Theef
Set victim IP and relative ports to 6703 and 2968 (or custom port)
Click to connect and open file manger.
NjRat
Execute NjRat
Insert IP and Port
Click on manager and open directory
Others possible ports can be: 5552, 9871, 6703.
HTTP RAT TROJAN
Web server trojan which allows access to victimโs machine via a web browser
Run httprat.exe
Disable the notification option.
Set server port 84. And create the httpserver.exe
Run this httpserver.exe on the victim machine.
Browser victimโs IP from attackerโs machine to gain web access to the victim
You can view processes, system info, view drives and directories
MoSucker GUI Trojan
Created in visual basic, can be set up to auto load on the victim machine, allows to perform many actions
Go to MoSucker Folder
Run CreateServer.exe.
Leave default settings. Press OK. Save filename as server.exe
Now MoSucker 3.0 Edit server window opens. Remember server Port 4288.
Select Keylogger option and Enable off-line keylogger.
Open MoSucker.exe and enter victim IP and port in given tabs.
On the window machine execute the server.exe file and you will get an error. Ignore the error.
On the attacker machine click on connect on the MoSucker.exe windows and you will be connected to the victim machine.
Start Live Capture to remotely view the machine
njRAT Tool :
open njRat v0.7.exe
check port no : 5552
click start
click on Builder
enter host ip ( attacker ip)
check checkBox - Copy To startup & Registry startup
click build
Other Tools
Cuckoo Sandbox: An open-source automated malware analysis system.
FireEye: A platform for detecting, preventing, and resolving advanced malware.
Joe Sandbox: A malware analysis platform that provides both static and dynamic analysis.
OllyDbg: A 32-bit assembler level analyzing debugger for Microsoft Windows.
IDA Pro: A multi-processor disassembler and debugger for Windows, Linux, and macOS.
Ghidra: A software reverse engineering framework developed by the NSA.
Radare2: A portable reversing framework that supports a wide range of architectures.
Process Monitor: A monitoring tool for Windows that shows real-time file system, registry, and process/thread activity.
Wireshark: A network protocol analyzer that lets you capture and interactively browse network traffic.
YARA: A tool for identifying and classifying malware based on patterns.
Volatility: A memory forensics framework for incident response and malware analysis.
The Sleuth Kit: A collection of command-line tools for digital investigation and analysis.
Autopsy: A digital forensics platform that provides a graphical interface for The Sleuth Kit.
Mandiant Redline: A free tool for host investigations and memory analysis.
Regshot: A utility that takes a snapshot of your system's registry and compares it to a second one.
PEiD: A tool that can detect the compiler/packer/cryptor of PE executables.
PEview: A lightweight and portable tool for viewing PE files.
PEStudio: A free tool that performs malware assessments on executable files.
Dependency Walker: A utility that scans any 32-bit or 64-bit Windows module and builds a hierarchical tree diagram of all dependent modules.
VirusTotal: A service that analyzes suspicious files and URLs to detect malware.
Additional Resources
Last updated