# How To Create A Telegram-RAT (Remote Access Trojan) 2020

**URL:** <https://onehack.st/t/how-to-create-a-telegram-rat-remote-access-trojan-2020/73149>\
**Category:** Tutorials & Methods\
**Tags:** programming, hacking, social-media\
**Created:** [March 12, 2020, 2:52pm UTC](https://onehack.st/t/how-to-create-a-telegram-rat-remote-access-trojan-2020/73149 "2020-03-12T14:52:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [March 12, 2020, 2:52pm UTC](https://onehack.st/t/how-to-create-a-telegram-rat-remote-access-trojan-2020/73149/1 "2020-03-12T14:52:58Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/c/b/cb47359e7f3cad5281786b6b907c2888896cfd3f.png)

There are a lot of hidden channels and bots with different illegal and piracy content.

In this tutorial we are going to learn how to build a Telegram as **Remote Access Toolkit (RAT)** that is undetectable by antivirus.

So, you can download it from Github or somewhere else and try to use IM as RAT

 ![image](https://onehack.st/uploads/default/original/3X/5/1/5197eafa350c33837fe10eece7acfb80c29d032b.jpeg)

Almost all of these projects use a **Python** code. So, anyone can compile a python code to **.exe** using tools like pyinstaller or kind of this.

On final you’ll get — **BOOM!** — an executable RAT tool, which is undetectable for antivirus’s!  
Cool, hah?

Here are some capabilities of _ **mvrozanti/RAT-via-Telegram** _ for instance:

```auto
arp - display arp table
capture_pc - screenshot PC
cmd_exec - execute shell command
cp - copy files
cd - change current directory
delete - delete a file/folder
download - download file from target
decode_all - decode ALL encoded local files
dns - display DNS Cache
encode_all - encode ALL local files
freeze_keyboard - enable keyboard freeze
unfreeze_keyboard - disable keyboard freeze
get_chrome - Get Google Chrome's login/passwords
hear - record microphone
ip_info - via ipinfo.io
keylogs - get keylogs
ls - list contents of current or specified directory
msg_box - display message box with text
mv - move files
pc_info - PC information
ping - makes sure target is up
play - plays a youtube video
proxy - opens a proxy server
pwd - show current directory
python_exec - interpret python
reboot - reboot computer
run - run a file
schedule - schedule a command to run at specific time
self_destruct - destroy all traces
shutdown - shutdown computer
tasklist - display services and processes running
to - select targets by it's name
update - update executable
wallpaper - change wallpaper

```

An attacker can **customize** the RAT (change an icon, add a certificate etc), then compile and send it as a phishing email attachment. What’s next? Anything!

Search for files (even on a network drives), execute apps and scripts, upload and download documents, receive a key logs, blah-blah — **anything!**

Of course — an attacker needs the infected workstation has Internet access. But I think it’s not a big deal for some reasons.

> HERE WE GO!

**1.** Modern malwares mostly created for long-term exploitation of IT-infrastructure. So, try to find a persistence points. The common way is to check the auto run keys:

 ![image](https://onehack.st/uploads/default/original/3X/a/5/a5b78aa79e0c652f0df7447b626543b0532b18f5.jpeg)

On this screenshot you see an application with Adobe icon but it has non-standard name and location — check it on **Virustotal** or related service if you found kind of this one.

By the way — this is the results of checking Telegram-based RAT executive file. As you see, just minor part of engines detected it as suspicious.

 ![image](https://onehack.st/uploads/default/original/3X/5/6/56f80bb86b947baa5c3ed01061d91ef6de31c5e7.jpeg)

**2.** Since something strange was found in the auto run, the next obvious step is to check the process list. Well, here we’ve found this Adobe-like process with active network session:

 ![image](https://onehack.st/uploads/default/original/3X/a/8/a8814a55114fbf62e3a6c4fd9bc242a28bff958d.jpeg)

Ok, let’s check this IP address… And — **BOOM!** — it’s a **Telegram IP**

 ![image](https://onehack.st/uploads/default/original/3X/a/3/a36f6528a347764c39c025c8cfb444273a6b4dc0.jpeg)

**3.** How to find out the behaviour of this process? Try to use [Process Monitor](https://docs.microsoft.com/en-us/sysinternals/downloads/procmon)!

To get a more comfortable view don’t forget to use filter by process & filesystem operations:

 ![image](https://onehack.st/uploads/default/original/3X/e/a/ea86fcf64bfcfad43e03415e5dbbcbcc05d9245a.jpeg)

You can see a lot of different operations on files and folders and some filenames give us an important information about the process functions (win32clipboard.pyd).

Moreover, we noticed the active process creates a number of temporary python files — we can use this knowledge further, during the investigation process.

 ![image](https://onehack.st/uploads/default/original/3X/7/3/7331de98b33d0bd9654675661226262f35860ec5.jpeg)

**4.** For instance, two ways to understand what date when RAT was started first time:

- Check the system prefetch list using [WinPrefetchView](https://www.nirsoft.net/utils/win_prefetch_view.html)

 ![image](https://onehack.st/uploads/default/original/3X/6/a/6a53107b83a9b95bd21e263da4e4db870a32a414.jpeg)

Check the processes’ network usage statistics from SRUM using [NetworkUsageView](https://www.nirsoft.net/utils/network_usage_view.html)

 ![image](https://onehack.st/uploads/default/original/3X/0/1/01b52a55ce8974d6b104c9d78b7359ed55014922.jpeg)

**hope you will like my tutorial fellas 🙂**

---

<div class="post-metadata">

**Author:** ![dydx](https://onehack.st/user_avatar/onehack.st/dydx/32/36729_2.png) [@dydx](https://onehack.st/u/dydx)\
**Post date:** [March 12, 2020, 4:49pm UTC](https://onehack.st/t/how-to-create-a-telegram-rat-remote-access-trojan-2020/73149/2 "2020-03-12T16:49:33Z")

</div>

That was dope… 🤠