How To: Trace RATs

 ██▀███      ██▓    ██▓███
▓██ ▒ ██▒   ▓██▒   ▓██░  ██▒
▓██ ░▄█ ▒   ▒██▒   ▓██░ ██▓▒
▒██▀▀█▄     ░██░   ▒██▄█▓▒ ▒
░██▓ ▒██▒   ░██░   ▒██▒ ░  ░
░ ▒▓ ░▒▓░   ░▓     ▒▓▒░ ░  ░
  ░▒ ░ ▒░    ▒ ░   ░▒ ░
  ░░   ░     ▒ ░   ░░
   ░         ░
[#] ~ r1p's guide on How To: Trace a RAT ~ [#]
*PLEASE NOTE* : there are otherways on how to do this but this is the most simple way.

If you are reading this you most likely don't know how to trace a rat. In this guide I will cover: How to protect yourself from RATs, How to "Trace" a RAT and what to do when you have gotten the owners IP/DNS.

Okay so before i start real quick, you will need these things:
-- VM or your own PC (if you use your own pc then you have guts.)
-- Sandboxie
-- Wireshark
-- A brain
-- Basic computer knowledge

1. Download a RAT (do not open it)
2. Install Sandboxie from here: https://www.sandboxie.com/
3. Install Wireshark from here: https://www.wireshark.org/
4. Scan the RAT in VirusTotal: https://www.virustotal.com/gui/
5. If it says a proper word in the detections like "Noancore" its a Nanocore RAT etc, lookup the names yourself
6. Open up wireshark and connect it to your wifi settings/adapter
7. Start pulling all the traffic
8. RIGHT CLICK! the RAT and press "Open in Sandboxie"
9. You will see that more traffic has rushed into your wireshark, that is GOOD
10. Goto the filter bar and type "dns" and press enter. It will show every dns running on your network
11. Find a suspicious looking DNS like "hacker4rat.ddns.net" they all have different addresses so yeah
12. Next to the DNS will be an IP Address, now if the owner of the RAT is retarded it will be their home connection otherwise its not

[#] ~ Congrats you found the IP Address, now moving onto what to do with that information ~ [#]
1. Firstly copy and paste the IP Address into https://www.ip-tracker.org/
2. Find the ISP and search for it in your browser, if it says the company is an ISP it is their home address otherwise its a VPN
3. Find what DNS Provider they are using, most people use No-Ip so try looking for a DNS address that matches the owners from there
4. Once you have found the DNS Provider report the DNS for "Hosting Malicious Apps"
5. You have now taken down a Ratter! :)

[#] ~ Now I will be telling you how to protect yourself from RATs ~ [#]
1. Install an anti-virus like Avast or Eset
2. When downloading things off the internet always scan the DIRECT exe in VirusTotal, DO NOT just scan the .RAR OR FOLDER
3. If the VirusTotal comes up with things like "Trojan\:tyHJ57Y" it is obfuscated and is most likely a virus
4. If you downloaded it off of a forum like HackForums or Nulled.to check the users reputation score if its negative it is malware
There you go! You have now protected yourself from RATs.
Please share this pastebin with others so they can also protect themselves.

#SuicideSec