Securi-Tay 2019: RATs, Crypters & Zombies: A History Of Consumer Malware

### Overview In this Securi-Tay 2019 presentation, Dan, a security engineer and student at Edinburgh Napier University, traces the history and commercial ecosystem of Remote Access Trojans (RATs) and consumer-grade malware. While malware developers frequently claim their tools are harmless "remote administration tools" equipped with disclaimers and End User License Agreements (EULAs), the talk illustrates how these programs evolved into offensive tools that power underground economies. Dan examines the technical progression of early tools, the monetization of infected systems ("zombies"), the underground support services (such as crypters and testing platforms), and the interventions required to deter young people from cybercrime.

### Key Topics - **Origins of Remote Administration Tools:** The distinction and overlap between legitimate remote management software and malicious RATs, beginning with late-1990s utilities. - **Botnets vs. RATs:** Comparing the streamlined, stealth-oriented architecture required for scalable botnets (used for spam and DDoS) versus the feature-dense, interactive design typical of consumer RATs. - **The Underground Commercial Ecosystem:** How platforms like Hack Forums lowered the barrier to entry by providing public marketplaces, reputation tiers, spreading guides, and customer support for script kiddies. - **Monetization of Compromised Systems:** Methods attackers use to exploit infected machines, including hosting malicious content, virtual gaming item theft, social media reputation hijacking, credential theft, ransomware, and webcam-based extortion/sextortion. - **Supporting Infrastructure:** The technical mechanisms of executable packing, crypters, and counter-antivirus services used to evade detection.

### Technical Details - **Early Tools:** - *NetBus (1998):* Created by Carl-Fredrik Neikter using a client-server model. It supported keystroke logging, keystroke injection, file system manipulation, display capture, CD-ROM tray control, and proxy tunneling. NetBus 2.0 Pro added scripting, multi-server storage, and webcam capture, and was notoriously used to plant illegal images to frame Lund University researcher Magnus Eriksson. - *Back Orifice (1998) & Back Orifice 2000:* Released at DEF CON by Sir Dystic of Cult of the Dead Cow. It featured stealth process hiding, network packet sniffing in promiscuous mode, an embedded HTTP server, and a modular plugin interface. - *Sub7 (SubSeven):* Developed by mobman, featuring extensive interactive management capabilities and pioneering command-and-control (C2) architecture over IRC. - **Modern Tools & Law Enforcement Actions:** - *DarkComet:* Developed between 2008 and 2012 by DarkCoderSC, amassing over 70,000 users before being terminated following its documented abuse against journalists by the Syrian regime. - *BlackShades:* Commercialized for $40 with dedicated customer support, offering a VB-based full version (BlackShades.NET) and a lightweight Java version (BlackShades Stealth). It implemented registry persistence, custom mutexes to prevent duplicate infections, cloned file attributes (e.g., spoofing `notepad.exe`), system hooks for keystroke capture, and built-in monetization plugins (Steam stealers, ad clickers). It was dismantled in a coordinated international operation involving dozens of raids by the FBI and Europol after generating over $350,000 in sales. - *njRAT & Luminosity Link:* Demonstrating widespread use across Asia, large-scale dynamic DNS takedowns (e.g., Microsoft targeting millions of No-IP subdomains), and operational security failures (such as Luminosity Link developer Colton Grubbs operating under "KFC Watermelon" using his personal Gmail and Skype). - **Crypters and Evasion:** - Execution packers store the encrypted payload inside a Portable Executable (PE) resource, using an uncompressed "stub" to decrypt or decompress code directly into memory upon launch. - Services range from free public packers to subscription-based public crypting services, private crypting services with capped seats and VM/sandbox detection, up to custom virtual machine-based bytecode obfuscators. - *Counter-Antivirus Scanners:* Attackers avoid Virustotal because it shares samples with AV vendors. Underground non-distributing scanning services (e.g., Refud.me, operating 2011–2015 before an NCA takedown) executed tools in sandboxed environments to verify detection evasion.

### Takeaways Consumer-facing malware persists not solely through advanced technical design, but through an accessible ecosystem of cheap supporting tools, forum tutorials, and poor operational security by amateur operators. Mitigating this threat cannot rely solely on an antivirus arms race. Instead, effective solutions require attacking the conversion of stolen digital assets into fiat currency, collaboration between security vendors and law enforcement, and early intervention programs (such as the UK NCA's Prevent program) that redirect technically inclined youth toward legitimate cybersecurity careers.