Powershell-RAT – Gmail Exfiltration RAT

[Fi8sVrs]

Python based backdoor that uses Gmail to exfiltrate data through attachment. This RAT will help during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends it to an attacker as an e-mail attachment.

 

Powershell-RAT

Python based backdoor that uses Gmail to exfiltrate data as an e-mail attachment.

 

This RAT will help someone during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends the information to an attacker as an e-mail attachment.

 

Note: This piece of code is Fully UnDetectable (FUD) by Anti-Virus (AV) software.

This project must not be used for illegal purposes or for hacking into system where you do not have permission, it is strictly for educational purposes and for people to experiment with.

 

Any suggestions or ideas for this tool are welcome - just tweet me on @ManiarViral

 

Screenshot:

On the first run of the Powershell-RAT user will get options as below:

 

Using Hail Mary option to backdoor a Windows machine:

 

 

 

Successfully taking screenshots of the user activity:

 

Data exfiltrated as an email attachment using Gmail:

Setup:

• Throwaway Gmail email address
• Enable "Allow less secure apps" by going to https://myaccount.google.com/lesssecureapps
• Modify the $username & $password variable for your account in the Mail.ps1 Powershell file
• Modify $msg.From & $msg.To.Add with throwaway gmail address

 

Download: Powershell-RAT-master.zip

 

Source