すべての収集プロジェクト

RAT

• 250+ オープンソース遠隔操作/C&Cツール、1200+ RAT分析レポート\C&C関連記事など。
• English Version

目次

• オープンソースツール
  • pupy -> (1)ツール (6)記事
  • Covenant -> (3)ツール (18)記事
  • Slackor -> (1)ツール (3)記事
  • QuasarRAT -> (1)ツール (9)記事
  • EvilOSX -> (1)ツール (9)記事
  • Merlin -> (1)ツール (3)記事
• 商用ソフトウェア
  • Team Viewer -> (7)ツール (34)記事
• マルウェア（一部）
  • Gh0st -> (5)ツール (23)記事
  • NanoCore -> (1)ツール (32)記事
  • NjRat -> (4)ツール (20)記事
  • Revenge RAT -> (1)ツール (9)記事
  • PlugX -> (1)ツール (40)記事
  • (25) RemcosRAT
  • (3) L0rdixRAT
  • (1) LodaRAT
  • (9) GulfRAT
  • (14) NetWireRAT
  • (1) JhoneRAT
  • (2) Dacls
  • (1) BlackRemote
  • (17) Orcus
  • (1) NukeSped
  • (21) DarkComet
  • (1) WarZone RAT
  • (16) BlackShades
  • (1) DenesRAT
  • (4) WSH RAT
  • (2) Qrypter RAT
  • (20) Adwind
  • (1) CannibalRAT
  • (3) jRAT
  • (5) jsRAT
  • (4) CrossRat
  • (1) ArmaRat
  • (6) RokRAT
• 公開サービスの利用
  • Telegram -> (3)ツール (2)記事
  • Twitter -> (2)ツール (6)記事
  • GMail -> (3)ツール (8)記事
  • Github -> (1)ツール (5)記事
  • DropBox -> (1)ツール (3)記事
  • ブロックチェーン -> (2)ツール (1)記事
  • その他 -> (15)ツール (5)記事
• 通信プロトコル
  • DNSプロトコル
    • (9) ツール
    • (18) 記事
    • Domain Generation Algorithm(DGA) -> (14)ツール (42)記事
  • ICMP -> (5)記事
  • WebSocket -> (2)ツール (5)記事
• C&C
  • Cobalt Strike -> (14)ツール (8)記事
  • ツール
    • (64) 新規追加
  • 記事
    • (258) 新規追加
• 遠隔操作
  • ツール
    • (9) Android
    • (5) Linux
    • (17) Windows
    • (4) Apple
    • (90) 新規追加
  • 記事

オープンソースツール

---

pupy

ツール

• [5265星][1m] [Py] n1nj4sec/pupy Pythonで記述された遠隔操作、後侵入ツール、クロスプラットフォーム（Windows, Linux, OSX, Android）

記事

• 2020.01 [TheCyberWire] PupyRAT is back. So is the Konni Group. Twitter storm over claims that MBS hacked Jeff Bezos....
• 2019.03 [hackingarticles] Command & Control Tool: Pupy
• 2017.11 [chokepoint] Pupy as a Metasploit Payload
• 2017.10 [boredhackerblog] Pupy shell over Tor
• 2017.02 [n0where] Open Source Cross Platform RAT: Pupy
• 2015.10 [hackingarticles] Hack Remote PC using Pupy – Remote Administration Tool

---

Covenant

ツール

• [1147星][6d] [C#] cobbr/covenant Covenant is a collaborative .NET C2 framework for red teamers.
• [95星][9d] [C#] cobbr/elite Elite is the client-side component of the Covenant project. Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.
• [31星][4m] [C#] cobbr/c2bridge C2Bridges allow developers to create new custom communication protocols and quickly utilize them within Covenant.

記事

• 2020.01 [csis] Embedding external DLLs into Covenant Tasks
• 2020.01 [hakin9] Covenant the .NET based C2 on Kali Linux | by Dan Dieterle
• 2019.12 [cyberarms] Covenant the .NET based C2 on Kali Linux
• 2019.12 [rastamouse] Covenant Tasks 101
• 2019.12 [rsa] Using RSA NetWitness to Detect C&C: Covenant
• 2019.11 [4hou] Covenant 利用分析
• 2019.11 [3gstudent] Covenant 利用分析
• 2019.10 [cobbr] Covenant: Developing Custom C2 Communication Protocols
• 2019.10 [specterops] Covenant: Developing Custom C2 Communication Protocols
• 2019.09 [freebuf] Covenant：レッドチーム向けに設計された.NETコマンドライン制御フレームワーク
• 2019.09 [stealthbits] Setup, Configuration, and Task Execution with Covenant: The Complete Guide
• 2019.08 [stealthbits] Next-Gen Open Source C2 Frameworks in a Post PSEmpire World: Covenant
• 2019.08 [rastamouse] Covenant, Donut, TikiTorch
• 2019.08 [cobbr] Covenant: The Usability Update
• 2019.08 [specterops] Covenant: The Usability Update
• 2019.02 [cobbr] Entering a Covenant: .NET Command and Control
• 2019.02 [rvrsh3ll]

---

Slackor

ツール

• [332星][12d] [Py] coalfire-research/slackor A Golang implant that uses Slack as a command and control server

記事

• 2019.09 [freebuf] Slackor：Go言語で書かれたC&Cサーバー
• 2019.08 [freebuf] Slackor：Slackをコマンド制御サーバーとして利用する方法
• 2019.06 [n00py] Introducing Slackor, a Remote Access Tool Using Slack as a C2 Channel

---

QuasarRAT

ツール

• [2932星][10m] [C#] quasar/quasarrat Remote Administration Tool for Windows

記事

• 2019.10 [UltraHacks] QuasarRAT [Free Download] | [TUTORIAL VIDEO] | Ultra Hacks
• 2018.09 [malwarebytes] Buggy implementation of CVE-2018-8373 vulnerability used to deliver Quasar RAT
• 2018.03 [4hou] マクロコードを利用してNetwiredRCとQuasar RATを拡散する悪意のあるRTF文書の詳細分析
• 2018.01 [paloaltonetworks] VERMIN: Quasar RAT and Custom Malware Used I
• 2017.12 [HackerSploit] QuasarRAT - The Best Windows RAT? - Remote Administration Tool for Windows
• 2017.11 [n0where] Free, Open-Source Remote Administration Tool for Windows: QuasarRAT
• 2017.10 [TechnoHacker] Quasar RAT review
• 2017.10 [rsa] MalSpam Delivers RAT SpyWare Quasar 9-27-2017
• 2017.01 [paloaltonetworks] Downeks and Quasar RAT Used in Recent Targeted Attacks Against Go

---

EvilOSX

ツール

• [1376星][2y] [Py] marten4n6/evilosx An evil RAT (Remote Administration Tool) for macOS / OS X.

記事

• 2019.07 [hackingarticles] EvilOSX-RAT for MacOS/OSX
• 2019.06 [NullByte] Take Control Over MacOS Computers with EvilOSX [Tutorial]
• 2018.08 [freebuf] EvilOSX：強力なmacOSリモート管理ツール（RAT）
• 2018.07 [pentesttoolz] EvilOSX – Evil Remote Administration Tool (RAT) for macOS/OS X – Kali Linux 2018.2
• 2018.06 [n0where] Pure python post-exploitation RAT for macOS & OSX: EvilOSX
• 2018.03 [applehelpwriter] defending against EvilOSX, a python RAT with a twist in its tail
• 2018.03 [binarydefense] EvilOSX - Binary Defense
• 2018.03 [binarydefense] EvilOSX
• 2017.11 [NullByte] EvilOSX RAT - How to build a payload and start a server

---

Merlin

ツール

• [2568星][6m] [Go] ne0nd0g/merlin Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

記事

• 2019.03 [hackingarticles] Command and Control Guide to Merlin
• 2018.02 [lockboxx] Merlin for Red Teams
• 2017.12 [n0where] Cross-Platform Post-Exploitation HTTP/2 Command & Control Server: Merlin

商用ソフトウェア

---

Team Viewer

ツール

• [405星][2y] [C++] vah13/extracttvpasswords Frida を使用して TeamViewer メモリからパスワードを抽出するツール
• [277星][2y] [C++] gellin/teamviewer_permissions_hook_v1 A proof of concept injectable C++ dll, that uses naked inline hooking and direct memory modification to change your TeamViewer permissions.
• [175星][9d] uknowsec/sharpdecryptpwd Windows システムに保存されているパスワードを解析するためのツール。対象：Navicat, TeamViewer, FileZilla, WinSCP, Xmangagerシリーズ製品（Xshell, Xftp）。
• [59星][2y] [Py] attackercan/teamviewer-dumper メモリから TeamViewer ID とパスワードをダンプ
• [42星][6d] [C#] v1v1/decryptteamviewer Enumerate and decrypt TeamViewer credentials from Windows registry
• [36星][5y] [C++] kkar/teamviewer-dumper-in-cpp 子ウィンドウを列挙して、実行中の TeamViewer インスタンスから ID、パスワード、アカウント設定をダンプ
• [25星][5m] [C++] dydtjr1128/remoteassistance-cpp [WIP] TeamViewer 風のリモートアシスタンス（C++）

記事- 2020.02 [yoroi] Importante Vulnerabilità su TeamViewer

• 2020.01 [freebuf] 「正規」監視ソフトがブラック産業に悪用、出力管理の甘さが別のTeamViewerを生むか？
• 2019.11 [sessionstack] TeamViewer, and Alternative Remote Access and Web Conferencing Solutions, Through the Lens of Customer Service
• 2019.10 [threatbook] 「TeamViewerハッキング騒動」は事実か誇張か？慌てるな！一読で対策方法がわかる
• 2019.10 [freebuf] TeamViewer「侵入」事件の調査と結論
• 2019.04 [4hou] トロイの木馬化したTeamViewerを使った複数国家政府機関への攻撃
• 2019.04 [0x00sec] Port 5900 open on a MAC that used Teamviewer, trying to access it
• 2018.09 [blackmoreops] Install TeamViewer on Kali Linux 2018
• 2018.08 [freebuf] あなたがダウンロードしたTeamViewer13クラック版には毒があるかもしれない
• 2018.08 [4hou] RMSとTeamViewerを使って工業企業を攻撃
• 2018.08 [kaspersky] Attacks on industrial enterprises using RMS and TeamViewer
• 2018.08 [securelist] Attacks on industrial enterprises using RMS and TeamViewer
• 2017.12 [4hou] TeamViewer 13.0.5058の権限脆弱性テスト
• 2017.12 [3gstudent] TeamViewer 13.0.5058の権限脆弱性テスト
• 2017.12 [3gstudent] TeamViewer 13.0.5058の権限脆弱性テスト
• 2017.12 [malwarebytes] Use TeamViewer? Fix this dangerous permissions bug with an update

マルウェア(一部)

---

Gh0st

ツール

• [301星][7d] [C++] yuanyuanxiang/simpleremoter gh0stベースのリモートコントローラー：端末管理、プロセス管理、ウィンドウ管理、リモートデスクトップ、ファイル管理、音声管理、ビデオ管理、サービス管理、レジストリ管理などの機能を実装
• [273星][7y] [C++] sin5678/gh0st a open source remote administrator tool
• [91星][6y] [C++] igh0st/gh0st3.6_src
• [90星][1m] [C++] zibility/remote Gh0stソースコードを参考に開発されたPCリモートアシスタンスソフト。リモートシェル、ファイル管理、デスクトップ管理、メッセージ送信などの機能を持つ。
• [21星][5m] [C++] holmesian/gh0st-light 簡略化された古いもの

記事

• 2020.01 [z3roTrust] Becoming Untraceable - 12.0_Gh0st_Us3r.dll
• 2020.01 [rsa] Detecting Gh0st RAT in the RSA NetWitness Platform
• 2019.06 [binarydefense] Gh0stCringe (Formerly CirenegRAT) - Binary Defense
• 2019.03 [alienvault] The odd case of a Gh0stRAT variant
• 2018.11 [trendmicro] 機械学習を使ってGh0st遠隔操作型トロイの木馬の亜種の悪意あるネットワークフローを分類
• 2018.08 [traffic] [2018-08-12] KaiXinEK->Gh0stRAT
• 2018.07 [traffic] [2018-07-16] KaiXinEK->Gh0stRAT
• 2018.07 [inquest] Field Notes: Malicious HFS Instances Serving Gh0stRAT
• 2018.07 [360] 遠隔操作型トロイの木馬Gh0st RATサンプルの初期分析
• 2018.05 [id] CryptGh0st
• 2018.05 [freebuf] Gh0st RAT亜種のネットワークデータをデコード
• 2018.04 [freebuf] Gh0st/大灰狼RATファミリー通信プロトコル分析
• 2018.04 [360] Gh0st/大灰狼RATファミリー通信プロトコル分析
• 2017.12 [traffic] [2017-12-06] KaiXinEK->Gh0stRAT
• 2016.06 [cysinfo] Hunting and Decrypting Communications of Gh0st RAT in Memory
• 2014.05 [pediy] [オリジナル]Gh0st3.6 windows7で接続できないバグ分析
• 2014.04 [pediy] [議論]Gh0st3.6 IOCP送信バグ

---

NanoCore

ツール

• [2星][10m] [Py] jacobpimental/nanocore_extractor コンパイルされたAutoITスクリプトからnanocoreサンプルを抽出

記事

• 2020.01 [molly] NanoCore: The RAT that keeps on keeping on. How to detect and prove an infection.
• 2019.11 [4hou] 二重ロードのZIPファイルがNanocore RATを拡散
• 2019.10 [morphisec] NanoCore RAT Under the Microscope
• 2019.06 [myonlinesecurity] More AgentTesla keylogger and Nanocore RAT in one bundle
• 2019.06 [myonlinesecurity] Nanocore RAT via fake DHL failed delivery in Chinese
• 2019.06 [4hou] NanoCore犯罪ソフトウェア攻撃チェーンを解析
• 2019.06 [yoroi] Dissecting NanoCore Crimeware Attack Chain
• 2019.05 [myonlinesecurity] nanocore RAT via fake order in password protected word doc with wrong password
• 2019.05 [myonlinesecurity] Fake Fedex Express Shipment For Pickup in iso delivers nanocore using Sendgrid
• 2019.05 [goggleheadedhacker] Unpacking NanoCore Sample Using AutoIT
• 2019.03 [carbonblack] TAU Threat Intelligence Notification: NanoCore – Old Malware, New Tricks!
• 2019.01 [myonlinesecurity] Fake Autec Power purchase Order delivers Nanocore RAT
• 2019.01 [myonlinesecurity] Nanocore via fake order using dde in csv files
• 2019.01 [myonlinesecurity] Nanocore RAT via fake order emails

---

NjRat

ツール

• [143星][2y] [Visual Basic .NET] alibawazeeer/rat-njrat-0.7d-modded-source-code NJR
• [128星][8d] [Visual Basic] mwsrc/njrat njRAT SRC Extract
• [14星][5m] [C#] nyan-x-cat/njrat-0.7d-stub-csharp njRAT C# Stub - Fixed For PowerShell
• [3星][2y] [Py] seep1959/njutils njrat 0.6.4、0.7d、および0.7dゴールデンエディション用のクライアント兼チャットプログラム。

記事

• 2019.12 [carbonblack] Threat Analysis Unit (TAU) Threat Intelligence Notification: njRAT
• 2019.09 [freebuf] Gorgon APTグループが再び動く：DropBoxからNJRatへの曲折の道のり
• 2019.05 [morphisec] A look at Hworm / Houdini AKA njRAT
• 2019.05 [myonlinesecurity] Fake Payment receipt vbs drops njrat bladabindi downloads Agent Tesla via Sendspace.
• 2018.11 [trendmicro] AutoItでコンパイルされたワーム、リムーバブルメディアを介して拡散、ファイルレス版のnjRATバックドアを配信
• 2018.06 [360] 古木に新花--njRATファミリーマルウェア分析レポート
• 2018.06 [freebuf] 技術討論 | NjRATがBase64エンコードによる難読化で360アンチウイルスを回避する実験
• 2018.04 [UltraHacks] njRAT v0.7 | Tutorial | www.ultrahacks.org | Ultra Hacks
• 2018.03 [broadanalysis] Guest Blog Post: njRat Analysis with Volatility
• 2018.01 [rsa] Malspam delivers njRAT 1-11-2018
• 2017.12 [malwarenailed] Revisiting HWorm and NjRAT
• 2016.12 [freebuf] 史上最も完全なnjRAT通信プロトコル分析
• 2016.08 [MalwareAnalysisForHedgehogs] Malware Analysis - Unpacking njRAT Protected by Confuser v.1.9 and others
• 2016.01 [sensecy] Is There A New njRAT Out There?
• 2015.12 [sec] トロイの木馬情報分析：njRAT&H-worm

---

Revenge RAT

ツール

• [21星][2m] [C#] nyan-x-cat/revengerat-stub-cssharp Revenge-RAT C# Stub - Fixed

記事

• 2020.01 [malware] 2020-01-15 - QUICK POST: MALSPAM PUSHING REVENGE RAT
• 2019.11 [fortinet] Double Trouble: RevengeRAT and WSHRAT
• 2019.09 [360] Revenge-RATがイタリアに対するフィッシングメール攻撃で使用される
• 2019.04 [4hou] フィッシングメールを利用してRevengeRATを拡散するAggah作戦
• 2019.03 [alienvault] Mapping TrickBot and RevengeRAT with MITRE ATT&CK and AlienVault USM Anywhere
• 2019.02 [4hou] Revenge RATマルウェアのアップグレード版が登場
• 2018.04 [dissectmalware] Stealthy VBScript dropper dropping Revenge RAT
• 2017.10 [rsa] Malspam Delivers Revenge RAT October-2017
• 2016.08 [deniable] Lurking Around Revenge-RAT

---

PlugX### ツール

• [28スター][7y] [Py] kcreyts/plugxdecoder Decodes PlugX traffic and encrypted/compressed artifacts

記事

• 2020.01 [hexacorn] The Wizard of X – Oppa PlugX style, Part 2
• 2019.11 [BorjaMerino] Rebind Socket Windows: PoC PlugX Controller
• 2018.06 [countuponsecurity] Digital Forensics – PlugX and Artifacts left behind
• 2018.05 [countuponsecurity] Malware Analysis – PlugX – Part 2
• 2018.02 [4hou] PlugX マルウェアファミリーの攻撃力を解明
• 2018.02 [360] PlugX マルウェア分析レポート
• 2018.02 [countuponsecurity] Malware Analysis – PlugX
• 2017.09 [fortinet] Deep Analysis of New Poison Ivy/PlugX Variant - Part II
• 2017.09 [fortinet] 新種の Poison Ivy/PlugX バリアントの詳細分析
• 2017.09 [360] Stack overflow in PlugX RAT
• 2017.07 [hexacorn] The Wizard of X – Oppa PlugX style
• 2017.02 [jpcert] PlugX + Poison Ivy = PlugIvy? - PlugX Integrating Poison Ivy’s Code -
• 2016.06 [airbuscybersecurity] Getting a PlugX builder
• 2016.06 [cylance] CylancePROTECT® vs. PlugX – JTB Breach Affects 7.93 Million People in Japan
• 2016.03 [securelist] PlugX malware: A good hacker is an apologetic hacker
• 2015.11 [volatility] PlugX: Memory Forensics Lifecycle with Volatility

---

RemcosRAT

• 2019.10 [fortinet] New Variant of Remcos RAT Observed In the Wild
• 2019.09 [myonlinesecurity] Some changes to Remcos Rat persistence method
• 2019.09 [myonlinesecurity] Fake invoice tries to deliver Remcos RAT
• 2019.09 [freebuf] フィッシングメールに含まれるRemcos RAT変種の分析
• 2019.08 [trendmicro] Analysis: New Remcos RAT Arrives Via Phishing Email
• 2019.06 [myonlinesecurity] Remcos Rat via fake invoice using multiple delivery methods.
• 2019.06 [HackerSploit] Remcos RAT Review - The Most Advanced Remote Access Tool
• 2018.11 [myonlinesecurity] More Fake DHL invoices delivering Remcos RAT via office XML files
• 2018.10 [myonlinesecurity] Fake DHL READ : (DHL Express) -Delivery Address Confirmation delivers Remcos Rat
• 2018.09 [myonlinesecurity] Fake Purchase Order email delivers Remcos RAT
• 2018.09 [360] Remcosのボットネットを解明
• 2018.08 [securityledger] Cisco Links Remote Access Tool Remcos to Cybercriminal Underground
• 2018.08 [talosintelligence] Picking Apart Remcos Botnet-In-A-Box
• 2018.08 [UltraHacks] Remcos RAT Tutorial | Remote Administration Tool | Ultra Hacks

---

L0rdixRAT

• 2019.08 [bromium] Decrypting L0rdix RAT’s C2
• 2019.07 [bromium] An Analysis of L0rdix RAT, Panel and Builder
• 2018.11 [ensilo] L0RDIX: Multipurpose Attack Tool

---

LodaRAT

• 2020.02 [talosintelligence] Loda RAT Grows Up

---

GulfRAT

• 2020.01 [TheCyberWire] Phishing with a RAT in the Gulf. More on how Jeff Bezos was hacked. Microsoft discloses data...
• 2020.01 [TheCyberWire] Escalation in the Gulf as a US air strike kills Iran’s Quds commander. Travelex and RavnAir...
• 2019.08 [nettitude] Tanker Cyber Attacks taking place in the Gulf
• 2017.09 [mikefrobbins] PowerShell Toolmaking session this Saturday, September 30th at Gulf Coast Code Camp 2017 in Mobile, Alabama
• 2016.11 [fireeye] FireEye Responds to Wave of Destructive Cyber Attacks in Gulf Region
• 2016.03 [elearnsecurity] Visit eLearnSecurity on Gulf Information Security and Gulf Expo 2016 in Dubai
• 2015.07 [welivesecurity] New report explains gulf between security experts and non-experts
• 2010.08 [publicintelligence] Los Zetas and Gulf Cartel Perpetrators of Mexican Drug Trafficking Violence Organizational Chart
• 2010.05 [publicintelligence] BP Minerals Management Service Workshop Brief: Unlocking Gulf of Mexico “Technological Challenges”

---

NetWireRAT

• 2020.01 [securityintelligence] New NetWire RAT Campaigns Use IMG Attachments to Deliver Malware Targeting Enterprise Users
• 2019.11 [carbonblack] Active C2 Discovery Using Protocol Emulation Part1 (HYDSEVEN NetWire)
• 2019.09 [fortinet] New NetWire RAT Variant Being Spread Via Phishing
• 2019.08 [malware] 2019-08-23 - DATA DUMP (URSNIF, RIG EK, NETWIRE RAT)
• 2019.04 [myonlinesecurity] Fake DHL Shipment Notification delivers Netwire Trojan
• 2018.11 [traffic] [2018-11-21] HookAds->FalloutEK->AZORult->NetWireRAT
• 2017.11 [myonlinesecurity] Fake HSBC Advising Service Payment Advice malspam delivers Netwire trojan
• 2017.10 [myonlinesecurity] Fake HSBC Swift Copy delivers Netwire trojan
• 2017.09 [TechnoHacker] NetWire HKCU/Run vs ActiveX Startup
• 2017.08 [TechnoHacker] Netwire Tutorial: How to Sign the Android Host
• 2017.04 [TechnoHacker] How to crypt Netwire with Cyberseal
• 2017.04 [TechnoHacker] Netwire RAT Review
• 2014.08 [paloaltonetworks] NetWire and MITRE
• 2014.08 [paloaltonetworks] New Release: Decrypting NetWire C

---

JhoneRAT

• 2020.01 [talosintelligence] JhoneRAT: Cloud based python RAT targeting Middle Eastern countries

---

Dacls

• 2019.12 [360] Lazarus GroupがDacls RATを使用してLinuxプラットフォームを攻撃
• 2019.12 [360] Dacls, the Dual platform RAT

---

BlackRemote

• 2019.12 [carbonblack] Threat Analysis Unit (TAU) Threat Intelligence Notification: BlackRemote RAT

---

Orcus

• 2019.11 [krebsonsecurity] Orcus RAT Author Charged in Malware Scheme
• 2019.01 [morphisec] New Campaign Delivers Orcus RAT
• 2018.04 [freebuf] SYLKファイルを介して拡散するOrcus遠隔操作トロイの木馬のサンプル分析
• 2017.12 [fortinet] Circle of the fraud: more information about Bitcoin Orcus RAT campaign
• 2017.12 [fortinet] Circle of the fraud: more information about Bitcoin Orcus RAT campaign
• 2017.12 [fortinet] A Peculiar Case of Orcus RAT Targeting Bitcoin Investors
• 2017.12 [fortinet] Orcus 遠隔操作がビットコイン投資家を標的に、ビットコイン取引ボット Gunbot に偽装して拡散
• 2017.05 [freebuf] Orcus VMの解決手順
• 2017.04 [hackingarticles] Hack the Orcus VM CTF Challenge
• 2017.04 [techanarchy] VulnHub Orcus Solution
• 2017.03 [vulnhub] hackfest2016: Orcus
• 2017.03 [vulnhub] hackfest2016: Orcus
• 2016.08 [deniable] Cracking Orcus RAT
• 2016.08 [deniable] Cracking Orcus RAT
• 2016.08 [deniable] Cracking Orcus RAT
• 2016.08 [paloaltonetworks] Orcus – Birth of an unusual plugin bu

---

NukeSped

• 2019.10 [fortinet] A Deep-Dive Analysis of the NukeSped RATs

---

DarkComet- 2018.09 [UltraHacks] How to setup DarkCometRAT 5.3.1 + Portforward

• 2018.04 [freebuf] CVE-2017-11882新動向：AutoITスクリプトを利用してDarkCometバックドアを放出
• 2018.03 [tencent] CVE-2017-11882新動向：AutoITスクリプトを利用してDarkCometバックドアを放出
• 2017.10 [rsa] Malspam Delivers DarkComet RAT October-2017
• 2017.01 [HackingMonks] Darkcomet Rat Tutorial (Trojans are awesome)
• 2016.02 [hackingarticles] Hack Remote PC using Darkcomet RAT with Metasploit
• 2015.11 [TechnoHacker] How to setup DarkComet RAT [Voice Tutorial] [Download Link]
• 2015.07 [SecurityBSidesLondon] Kevin Breen - DarkComet From Defense To Offense - Identify your Attacker
• 2015.03 [heimdalsecurity] Security Alert: Infamous DarkComet RAT Used In Spear Phishing Campaigns
• 2015.03 [sketchymoose] Smooshing the Square Peg into the Round Hole: DarkComet Plugin for 64-bit images
• 2012.07 [freebuf] DarkComet RAT作者がプロジェクトの開発停止を発表
• 2012.06 [freebuf] [更新]強力な遠隔操作 – DarkComet RAT V5.3.1
• 2012.06 [malwarebytes] You dirty RAT! Part 1: DarkComet
• 2012.04 [trendmicro] Fake Skype Encryption Software Cloaks DarkComet Trojan
• 2012.04 [toolswatch] DarkComet-RAT Remote Administration Tool v5.1.1 released
• 2012.03 [quequero] DarkComet Analysis – Understanding the Trojan used in Syrian Uprising

---

WarZone RAT

• 2018.11 [UltraHacks] Warzone RAT C++ | Hidden VNC [PROMOTION VIDEO]| Ultra Hacks

---

BlackShades

• 2017.01 [TechnoHacker] Blackshades Revisited
• 2016.02 [TechnoHacker] How to use Blackshades [download link]
• 2016.02 [TechnoHacker] How to setup Blackshades RAT [Voice Tutorial] [download link]
• 2014.05 [malwarebytes] Taking off the Blackshades
• 2014.05 [endgame] Blackshades: Why We Should Care About Old Malware
• 2014.05 [trendmicro] The Blackshades RAT – Entry-Level Cybercrime
• 2014.05 [publicintelligence] FBI Blackshades Remote Access Tool Private Sector Bulletins and Domain List
• 2014.05 [alienvault] Blackshades Smackdown & Poking China in the Eye
• 2014.05 [cylance] A Study in Bots: BlackShades Net
• 2014.05 [welivesecurity] Behind Blackshades: a closer look at the latest FBI cyber crime arrests
• 2014.05 [krebsonsecurity] ‘Blackshades’ Trojan Users Had It Coming
• 2014.05 [malwaretech] FBI Cybercrime Crackdown – Blackshades
• 2012.07 [malwarebytes] BlackShades Co-Creator Arrested!
• 2012.06 [malwarebytes] BlackShades in Syria
• 2012.06 [citizenlab] Syrian Activists Targeted with BlackShades Spy Software

---

DenesRAT

• 2019.10 [nsfocus] 海莲花（APT32）組織 DenesRATトロイの木馬と関連攻撃チェーン分析

---

WSH RAT

• 2019.10 [angelalonso] WSH RAT - Analysis of the code
• 2019.10 [angelalonso] Fudcrypt using H-Worm from WSH RAT
• 2019.09 [freebuf] ハッカーが新型WSH RAT最新変種サンプルを購入し、銀行顧客を攻撃
• 2019.09 [angelalonso] WSH RAT and the link to unknowcrypter and Fudcrypt

---

Qrypter RAT

• 2018.04 [4hou] ますます流行するQrypter RATの動作状況を分析
• 2017.12 [angelalonso] Qrypter Java RAT using Tor

---

Adwind

• 2019.08 [4hou] Adwind遠隔操作は現在、公共事業部門の攻撃活動に広く利用されている
• 2018.10 [reversinglabs] eWeek: Cisco Talos and ReversingLabs warn that the Adwind Remote Access Trojan (RAT) has added capabilities that enable it bypass some anti-virus technologies
• 2018.04 [4hou] スパムメールキャンペーンがXTRAT、DUNIHI、Adwindバックドアを使用
• 2018.04 [trendmicro] トレンドマイクロ研究者、スパムメールがクロスプラットフォーム遠隔操作Adwindを拡散し、同時にバックドアXTRAT、DUNIHI、Lokiをバンドルしていることを確認
• 2018.04 [ensilo] enSilo Blocks New Variant of Adwind RAT
• 2018.03 [OALabs] Analyzing Adwind / JRAT Java Malware
• 2018.03 [heimdalsecurity] Security Alert: Spam Campaign Spreads Adwind RAT variant, Targeting Computer Systems
• 2018.02 [fortinet] New jRAT/Adwind Variant Being Spread With Package Delivery Scam
• 2018.02 [rsa] Winds of Winter - MalSpam Delivers Adwind RAT 2-1-2018
• 2018.02 [myonlinesecurity] Fake Swift Copy malspam via compromised sites delivering Java Adwind/ QRAT /JRAT Trojan
• 2017.12 [myonlinesecurity] Fake “Your UPS Invoice Is Ready” malspam delivers Java Adwind / Java JRAT Trojan
• 2017.08 [netskope] Adwind RAT employs new obfuscation techniques
• 2017.07 [trendmicro] Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind

---

CannibalRAT

• 2018.02 [talosintelligence] CannibalRAT targets Brazil

---

jRAT

• 2018.10 [cofense] H-Worm and jRAT Malware: Two RATs are Better than One
• 2018.08 [Sebdraven] Lammers, stealers and RATs: same technics like Formbook malware to install JRAT and HawkEye…
• 2018.03 [trustwave] Crypter-as-a-Service Helps jRAT Fly Under The Radar

---

jsRAT

• 2018.02 [netskope] ShortJSRAT leverages cloud with scriptlets
• 2017.07 [rsa] Recreating the Crime Scene - A JSRat Story
• 2016.05 [evi1cg] JSRATのいくつかの起動方法
• 2016.03 [hackingarticles] Hack Remote Windows 10 PC using JSRAT
• 2015.07 [secist] JSRATを使用してwin10システムをリモート管理

---

CrossRat

• 2018.01 [360] グローバルなサイバースパイ活動におけるクロスプラットフォームマルウェア-CrossRATの分析（下）
• 2018.01 [4hou] CrossRatリモートコントロールソフトウェアの分析
• 2018.01 [360] グローバルなサイバースパイ活動におけるクロスプラットフォームマルウェア-CrossRATの分析（上）
• 2018.01 [objective] グローバルなサイバースパイ活動に使用されるクロスプラットフォーム遠隔操作CrossRATの分析

---

ArmaRat

• 2018.09 [360] ArmaRat：イランユーザーを対象とした2年にわたるスパイ活動

---

RokRAT

• 2018.01 [morphisec] Threat Profile: RokRAT
• 2017.12 [MalwareAnalysisForHedgehogs] Malware Analysis - ROKRAT Unpacking from Injected Shellcode
• 2017.11 [talosintelligence] ROKRAT Reloaded
• 2017.06 [alienvault] A RAT that Tweets: New ROKRAT Malware Hides behind Twitter, Amazon, and Hulu Traffic
• 2017.04 [360] クラウドプラットフォームを使用したROKRATトロイの木馬分析
• 2017.04 [talosintelligence] ROKRAT遠隔操作分析：フィッシングからペイロードまで、Twitter/Yandex/MediafireをC&Cとして使用

---

CatKARAT

• 2018.01 [hackingarticles] TCP & UDP Packet Crafting with CatKARAT

---

TheFatRat

• 2018.11 [freebuf] 技術共有 | TheFatRatであなたのAndroidスマートフォンをハッキングする方法
• 2017.11 [TheHackerStuff] TheFatRat - Hacking Over WAN - Embedding Payload in Original Android APK - Without Port Forwarding
• 2016.12 [TheHackerStuff] Kali Linux - TheFatRat - Creating an Undetectable Backdoor - Bypass all AntiVirus
• 2016.09 [freebuf] TheFatRat：Msfvenomの簡単なバックドア生成ツール
• 2016.07 [hackingarticles] Hack Remote Windows 10 PC using TheFatRat

---

OmniRAT

• 2017.07 [skycure] Nasty backdoor OmniRAT is back, disguised as GhostCtrl on Android mobile devices
• 2015.11 [freebuf] OmniRAT変種トロイの木馬が悪用される

---

LuminosityLink

• 2018.10 [welivesecurity] LuminosityLink RAT pack leader jailed 30 months in the US
• 2018.02 [paloaltonetworks] RAT Trapped? LuminosityLink Falls Foul of Vermin Eradicatio
• 2017.05 [UltraHacks] How to setup LuminosityLink RAT with nVPN | PORTFORWARD FIX!!!
• 2017.05 [umbrella] The Weather Report: Seamless Campaign, LuminosityLink RAT, and OG-Miner!
• 2017.03 [myonlinesecurity] Request for 1st new order proforma invoice malspam delivers LuminosityLink RAT
• 2016.07 [paloaltonetworks] Investigating the LuminosityLink Remote Access Trojan Conf

---

その他- 2020.02 [proofpoint] Proofpoint Q4 2019 脅威レポートおよび年間レビュー — RATの年はさらに同様の内容で終了

• 2020.01 [sentinelone] CISO エッセンシャル | リモートアクセストロイの木馬がエンタープライズに与える影響
• 2020.01 [TheCyberWire] RAT、バックドア、およびリモートコード実行のゼロデイ。三菱電機への侵入、Telnet...
• 2020.01 [freebuf] 有効なデジタル証明書に埋め込まれた遠隔操作トロイの木馬ウイルスの分析レポート
• 2020.01 [rambus] Cable Haunt の脆弱性により、ハッカーが約2億台のケーブルモデムにリモートアクセスできる可能性
• 2020.01 [proofpoint] 脅威インサイト 2019 年振り返り: RAT の年
• 2019.12 [ptsecurity] トルコのトリック：ワーム、RAT…そしてフリーランサー
• 2019.12 [infosecinstitute] マルウェアスポットライト: リモートアクセストロイの木馬（RAT）とは
• 2019.12 [UltraHacks] Dark Shades Android RAT | Ultra Hacks
• 2019.11 [broadanalysis] Fallout Exploit Kit が疑わしいリモートアクセストロイの木馬（RAT）を配信
• 2019.11 [carbonblack] 脅威分析ユニット（TAU）脅威インテリジェンス通知: AsyncRAT
• 2019.11 [proofpoint] Proofpoint Q3 2019 脅威レポート — Emotet の復活、RAT の支配、そしてさらに
• 2019.10 [tencent] 快Go鉱夫（KuaiGoMiner）が数万台のコンピュータを制御してマイニング、遠隔操作トロイの木馬を放出して機密を窃取
• 2019.10 [4hou] 快Go鉱夫（KuaiGoMiner）が数万台のコンピュータを制御してマイニング、遠隔操作トロイの木馬を放出して機密を窃取
• 2019.10 [proofpoint] TA505、Get2 ダウンローダーと共に新しい SDBbot リモートアクセストロイの木馬を配布
• 2019.10 [tencent]

---

Read more