In a simple way? If I use VirusTotal (for example) how do I differentiate if it's just the RAT or if it's also backdoored? Or is there software to check?

  • You don't just know and there is no software to check. If there would be such software - how would you know that it does not lie to you or might even have a backdoor by itself? At the end it boils down to a) trust the "vendor" or b) your ability to debug code and find out yourself hat it does – Steffen Ullrich Nov 21 '17 at 8:06

The problem of assessing the security of "blackhat" software is, as you've mentioned, that many automated checkers will flag it due to it's purpose.

So this leaves you in a situation where you'd need to either "trust" the vendor, as @steffen-Ullrich says in comments or complete a manual assessment of the tool to ensure that it's doing what you want.

One approach to this would be to deploy the tool into an instrumented environment which can log changes in system files and network traffic and then put it through it's paces. Then review the logs provided to see whether the changes and traffic that was generated meet your expectations.

Of course this runs across all the possible problems of the tool having implemented anti-forensics technology either as part of it's primary purpose or as past of a backdoor.

If you have access to the source code you could obviously review that, and then ideally build from the source code you have. Assuming you've got the capabilities to complete that review, then that would provide more assurance.

Fundamentally it depends on how important it is to you to assure this software and the level of effort you're willing to go to.

| improve this answer | |
  • Can you please suggest such software? (logging network/system files/..) – user164273 Nov 21 '17 at 16:07
  • It's not really my specialist field, but something like cuckoosandbox.org would seem like a good starting point – Rory McCune Nov 21 '17 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.