A remote administration tool (RAT) is a piece of software or programming that allows a remote "operator" to control a system as if they have physical access to that system. While desktop sharing and remote administration have many legal uses, "RAT" software is usually associated with criminal or malicious activity. Malicious RAT software is typically installed without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its operation from the victim and from security software.
Contents
The operator controls the RAT through a network connection. Such tools provide an operator the following capabilities:
Its primary function is for one computer operator to gain access to remote PCs. One computer will run the "client" software application, while the other computer(s) operate as the "host(s)".
RAT trojan horses
Contrary to popular belief, the first ever RAT Trojan Horse was the infamous DarkComet RAT, by DarkCodersc.
Many trojans and backdoors now have remote administration capabilities allowing an individual to control the victim's computer. Many times, a file (often called a client or stub) must be opened on the victim's computer before the hacker can have access to it. These are generally sent through email, P2P file sharing software, and in internet downloads, and are usually disguised as a legitimate program or file. Many clients/stubs will display a fake error message when opened, to make it seem like it didn't open. A well-designed RAT will allow the operator the ability to do anything that they could do with physical access to the machine. RAT trojans can generally do the following:
Some RAT trojans are pranks that are most likely being controlled by a friend or enemy on April Fool's Day or a holiday. Prank RATs are generally not harmful, and won't log keystrokes or store information about the system on the computer. They usually do disruptive things like flip the screen upside-down, open the CD-ROM tray, or swap mouse buttons.