SharK 3.0 Remote Administration Tool

What comes into your mind when i tell you "RAT" ?
Nope, this is not related to Narcs or Informants. RAT means Remote Administration Tools. In the old days, almost every security tester used to play with BackOrifice2 (famous Cult of the Dead Cow greatest software ).

The previous day, a fellow security expert called me asking for help. He’s been told to keep an eye on some rogue computers that violate his organisation’s security policy. The computers were unauthorized to plug into the LAN without accepting security rules and policies.

He fired some old perl utilities (oldies but goodies), busted the IP addresses and successfully get connections to some rogue systems (he also knows metasploit kungfu), but he was unable to set and maintain a remote access.

I immediately suggested him a good RAT software among others* i’ve discovered when it first released to a "closed" circle of members. This tool is called SharK.

*I’ll write a little guide about some good RAT to keep an eye on.

The next coming day, i received his impressions.

“WOOOW, du jamais vu. Exceptionnel.â€

«Which means : Wooow, Unrated. Rocks !!»

Here are some SharK features:

• mRC4 Encrypted Traffic (New & Modded)
• zLib Compressed Traffic
• Highspeed, Stable Screen/Cam Capture
• Keylogger with highlight feature
• Remote Memory Execution & Injection
• VERY fast file manager/registry editor listing due to unique technic
• Anti: Debugger, VmWare, Norman Sandbox, Sandboxie, VirtualPC, Symantec Sandbox, Virtual Box
• Supporting Random Startup and Random Servernames
• Desktop Preview in SIN Console
• Sortable and Configuratable SIN Console
• Remote Autostart Manager
• optional Fwb++ (Process Injection, API Unhook)
• Folder Mirroring
• very userfriendly interface
• Use of plugins and additional add-ons

Warning : This tool is not developed for script kiddies and push-button-hackers. It targets Security professionals and researchers.

By the way, SharK has been added to Security-Database Tracking Tools Monitor.