Awesome
Remote-Access-Trojan-Database
All samples in this database can only used for research purpose.
the status of all RAT families including programming language used to write RAT stubs, the debut year of RAT families and source to determine the debut year.
The forth column represents the source based on which we determined the year, which could be divided into 3 types: public online documents, compilation timestamp, and the About description. For the About information, some RAT developers leave the change logs with timestamp in the About window of RATs' control panels, which is useful to identify the debut year.
Explore possible implementation methods of each function from the above RAT families
| KeyLogger | Descriptions & Key APIs |
|---|
| K1 | RATs invoke NtUserSetWindowsHookEx to register a callback function into a message hook chain of Windows. The callback function will receive a virtual key code when victims press the key. |
| K2 | RATs invoke NtUserGetAsyncKeyState in an endless loop to poll every key state. |
| K3 | RawInput is another channel to get user input. RATs invoke NtUserGetRawInputData to get input when a WM_INPUT message occurs. |
| RemoteCamera | Descriptions & Key APIs |
|---|
| C1 | Leveraging DirectShow to access cameras. The DirectShow is a media-streaming architecture for Microsoft Windows. RATs first invoke CoCreateInstance and CreateClassEnumerator to find the video input device. Then they invoke several APIs (e.g., SetFiltergraph, SetOutputFileName, etc.) to do some configuration works. Finally, they invoke RenderStream to capture video. |
| C2 | VFW is another multimedia framework developed by Microsoft that allows Windows to play and encode digital video. RATs first invoke capGetDriverDescription to retrieve information of video input devices, and then invoke capCreateCaptureWindow to create a capture window. Finally, they invoke SendMessage to send messages to the created window to connect and capture cameras. |
| AudioRecord | Descriptions & Key APIs |
|---|
| A1 | Leveraging the built-in Waveform-Audio interface to capture audio. RATs first invoke waveInOpen to open an audio input device. Then they invoke waveInPrepareHeader and waveInAddBuffer to prepare buffer blocks for audio data. Finally, they invoke waveInStart to start capturing audio. |
| A2 | The Media Control Interface (MCI) is another built-in interface which provides standard commands for recording multimedia devices. RATs first invoke mciSendCommand with a MCI_OPEN command to open an audio input device, and then invoke the same API mciSendCommand with another command MCI_RECORD to start audio recording. |
TBC