Assessing the Criminal Viability of BitRAT Relative to Open-Source RATs and Established Crimeware

A comparative capability, provenance, and operational-viability analysis — Revision 2

Prepared for internal threat-intelligence use · Classification: TLP:CLEAR · Scope: open-source assessment

1. Thesis and key findings

Thesis. BitRAT is a closed-source, commercially sold remote access trojan, and it is labelled “crimeware” largely on that basis. This report argues that closed, for-sale distribution did not make BitRAT a more criminally viable tool than the freely available open-source RAT ecosystem — and on the evidence, made it less so in practice. On capability it is at rough parity with the open-source AsyncRAT/Quasar lineage; on originality it is entirely derivative; on real-world evasion and longevity it is measurably inferior; and its one nominal differentiator — being closed and sold — was never real exclusivity, since its source had already been leaked to GitHub in 2020, its launch year.

Key findings.

1. Capability parity, not superiority. BitRAT’s feature set (remote control, keylogging, screen/webcam/mic capture, credential theft, HVNC, AV tampering, UAC bypass, persistence, in-memory loader, DDoS, clipboard monitoring, XMRig mining) is matched by the open-source AsyncRAT/Quasar fork ecosystem. The one meaningful capability the ecosystem has and BitRAT lacks is ransomware/file-encryption (present in DCRat, VenomRAT, XWorm).

2. Zero novel offensive engineering — confirmed by two independent analyses. Every non-trivial BitRAT component is copied from public or leaked sources: HVNC from TinyNuke, the loader from legacy crypters, the BSOD routine from Stack Overflow, the AV-killer from commodity Defender-disable scripts, and the config crypto from an open-source Camellia implementation. Two separate reverse-engineering writeups (KrabsOnSecurity 2020; OALABS 2022) reach the same “pasted C++” characterisation. Pasting is category-wide — even AsyncRAT reuses Quasar’s cryptography classes verbatim.

3. Poor evasion posture / low crypter viability. BitRAT builds were shipped UPX-packed, with stubs of roughly 1.9 MB (standard) and ~5 MB for the Tor variant, which drops the entire Tor binary to disk. UPX is a compressor, not a crypter, and is trivially and automatically reversed (upx -d); combined with multi-megabyte, high-entropy, high-signature stubs, this yields a weak posture against the stock Windows Defender/EDR baseline present on every modern Windows host. A RAT that cannot be effectively crypted has limited intrusion viability against defended targets regardless of its feature list.

4. Defunct and largely untracked. The vendor announced retirement on 23 Jan 2023 and the login/build infrastructure went permanently offline in March 2023 (documented in the HackForums sale thread — see Appendix A). The tool is not tracked as a distinct family in ANY.RUN’s Malware Trends Tracker, whereas contemporaries such as WarZone RAT (vendor delisted 2023) and MassLogger (2020) remain listed. By the community-telemetry measure, BitRAT is less present in the current ecosystem than discontinued competitors.

5. The “closed advantage” was never real. BitRAT’s source has been publicly available on GitHub (the Snykes repository) since 2020 — the same year it launched — an unauthorised leak predating the vendor’s own shutdown by roughly three years. For its entire commercial life, BitRAT’s source was as freely available as AsyncRAT’s or Quasar’s; buyers paid $20 for the vendor’s “official” builds of a codebase already on GitHub. Its sole nominal difference from the open-source RATs — being “closed” — was a marketing/monetisation posture, not actual exclusivity.

6. A real crimeware benchmark is a different class of object. DanaBot — a Delphi banking trojan run as an affiliate MaaS, delivering follow-on ransomware and cryptominers, with 1,000+ C2 servers, dismantled under Operation Endgame in 2025 — derives its viability from criminal operation at scale, not a feature checklist. Neither BitRAT nor the open-source RATs approach it on those terms.

Bottom line. If BitRAT is “crimeware,” so is the entire open-source RAT ecosystem it copies from — they share capabilities and pasted provenance. And measured on the axes that actually matter operationally (evasion, longevity, adoption), BitRAT underperforms the lean, actively maintained open-source alternatives. Its closed, for-sale model was a commercial choice that conferred no durable criminal advantage, and it is now moot.

2. Scope, sourcing, and method

This assessment is built entirely from published third-party analysis, public tool documentation, and community telemetry, supplemented by the report author’s first-hand observations of BitRAT build artefacts (noted as such where relied upon). It does not depend on, and does not perform, independent deobfuscation or devirtualisation of any BitRAT sample; the controller is protected with Eazfuscator virtualisation, but the payload’s behaviour, command set, configuration scheme, packing, and component provenance are documented in public research and cited accordingly.

Two independent technical analyses anchor the BitRAT internals: KrabsOnSecurity (Aug 2020) and OALABS “BitRat Exposed” (Oct 2022). Prevalence is assessed against ANY.RUN’s Malware Trends Tracker. Comparators bracket the question: AsyncRAT and QuasarRAT (stock, upstream repositories); the AsyncRAT/Quasar fork ecosystem (DCRat, VenomRAT, XWorm) as the open-source capability ceiling; and DanaBot as the professionally operated crimeware reference.

Two claims rest on the author’s primary analysis of build artefacts rather than a third-party citation and are flagged inline: (a) builder-enforced UPX packing; (b) stub sizes of ~1.9 MB / ~5 MB (Tor). These are consistent with Krabs’ independent confirmation that BitRAT drops the Tor binary to disk. The vendor-shutdown timeline is documented from primary screenshots of the HackForums sale thread (Appendix A), and the sample set backing the packing claims is catalogued in Appendix B.

3. Subject profiles

BitRAT. A RAT sold from 2020 on HackForums by “UnknownProducts” for $20 for lifetime access. The controller is a .NET application obfuscated with Eazfuscator; the implant is a Visual C++ binary statically linked against Boost and libcurl, using OpenCV for webcam capture. Licensing is enforced by an HWID check against a Tor-hosted vendor server, and payloads are built server-side. Advertised and documented capabilities include remote access, HVNC/hidden browser, keylogging, credential/password theft, webcam and audio capture, UAC bypass, DDoS, clipboard monitoring, and XMRig cryptomining. Two independent analyses characterise it as pasted C++ — “an amalgamation of poorly pasted leaked source code slapped together alongside a fancy C# GUI.” [1][2][6][7] It was used in real campaigns in 2021–2022 (notably by Blind Eagle / APT-C-36 against Latin American banking targets, and via pirated-Windows-activator lures) before its vendor operations lapsed; its source code was subsequently published to GitHub. [8][9][10]

AsyncRAT. Open-source C# RAT (GitHub, 2019). Stock feature set: plugin system, remote terminal, screen viewer/recorder, keylogger, SFTP, password recovery, configurable anti-analysis. [3] Researchers describe its stock capabilities as “not that impressive on their own,” with impact deriving from its open-source nature and prolific fork tree. [4]

QuasarRAT. Open-source C# RAT (MIT, 2014/xRAT→2015). Remote desktop, keylogging with window-title context, file management, screen capture, browser credential recovery; persistence via scheduled tasks and registry Run keys. [5][11][12]

Fork ecosystem (open-source ceiling). DCRat adds webcam/mic capture, Discord-token theft, AMSI/ETW patching, a process denylist, and a file-encryption (ransomware) module. [4] VenomRAT (Quasar fork) adds a working HVNC module (v5.6+), hidden-browser control, Defender disabling, anti-kill, a stealer module, and poorly implemented ransomware/encryption, sold on forums with bulletproof VPS. [13][14][15] XWorm bundles DDoS, USB propagation, clipping, ransomware, and HVNC, free on GitHub and sold as MaaS. [16]

DanaBot (crimeware benchmark). Modular Delphi banking trojan and infostealer, first identified May 2018, operated as a malware-as-a-service. A single Russia-based group controls a global C2 panel and leases access to affiliates for roughly $3,000–$4,000 per month, promoting the toolset on Russian-language forums with a Tor support page and distribution bundles with cryptor/loader partners; development was sustained, with a formal tiered-pricing revamp in 2023 and at least nine loader updates between 2023 and May 2025 — including a preview of a new custom cryptor days before the takedown. [17][18][23][24] Capabilities span web-inject banking fraud, credential/infostealing, screenshots, keylogging, SOCKS proxy, and full remote access; it is used to deliver follow-on ransomware and cryptominers, and a dedicated second botnet was run for espionage against military, diplomatic, and government targets, with observed DDoS against Ukraine’s Ministry of Defense after the Russian invasion. [17][20][22][23][25]

On 22 May 2025, as part of Operation Endgame, the U.S. DOJ unsealed a grand-jury indictment (filed in the Central District of California, 20 Sept 2022) charging 16 defendants, naming alleged administrator Aleksandr Stepanov (“JimmBee”) and sales/support operator Artem Aleksandrovich Kalinkin (“Onix”) of Novosibirsk, Russia; Kalinkin faces a statutory maximum of 72 years. The coordinated action (FBI Anchorage, DCIS, Germany’s BKA, Netherlands National Police, Australian Federal Police, Europol/Eurojust, and a dozen private firms including ESET, CrowdStrike, Proofpoint, and Zscaler) took down roughly 300 servers and 650 domains and issued 20 arrest warrants. DanaBot is assessed to have infected over 300,000 computers and caused at least $50 million in damage; several defendants were reportedly identified after infecting their own machines. [22][23][24][25]

4. Matrix 1 — BitRAT vs. stock open-source RATs

Comparison against the upstream AsyncRAT and Quasar repositories. Entries reflect stock builds; fork additions are captured in Matrix 2.

Reading. Against stock builds, BitRAT is broadly more feature-complete — expected, since it is a finished commercial product and the open-source RATs are defined by their forks, not their base repositories. The correct comparison is therefore against the ecosystem (Matrix 2).

5. Matrix 2 — BitRAT vs. the open-source ecosystem ceiling

Comparison against the freely available AsyncRAT/Quasar derivative family. “OSS ecosystem” denotes capability present in one or more widely used open-source forks (DCRat, VenomRAT, XWorm).

Reading. Corrected for BitRAT’s DDoS/clipper/miner, the two feature sets are near-identical. The residual differences favour the open-source ecosystem: it adds ransomware/file-encryption and self-propagation that BitRAT lacks, and cleaner in-memory evasion (AMSI/ETW patching) than BitRAT’s crude WinExec Defender-killer. BitRAT is not the ceiling of this category; it sits inside it, and below the most capable free forks. Independent research places the same HVNC technique in VenomRAT and BitRAT alike — the same class, not a hierarchy. [14]

6. Provenance — the originality axis

Two independent reverse-engineering efforts document BitRAT as contributing no novel offensive technique:

• HVNC / hidden browser — a near-verbatim TinyNuke paste; the AVE_MARIA traffic header was left unchanged and the dropped hvnc.exe is a TinyNuke ripoff. [1]
• Windows Defender killer — 32 reg/schtasks commands run via the legacy WinExec API; commodity “disable Defender” scripting widely shared publicly, not from TinyNuke. [1]
• Download-and-execute loader — libcurl-to-memory download plus process hollowing/runPE of a legacy-crypter style. [1]
• BSOD routine — copied from a Stack Overflow answer. [1]
• String encryption — LeFF’s constexpr compile-time trick, copied unmodified (confirmed independently by OALABS). [1][2]
• Configuration encryption — a wrapper around an open-source Camellia implementation, keyed by an MD5 of a concatenated string (config-extraction methodology and format independently reproduced by OALABS). [1][2]
• UAC bypass — the publicly documented fodhelper technique. [1]

OALABS’ independent 2022 analysis reaches the same conclusion, labelling BitRAT a “C++ paster RAT” and reproducing its Camellia config scheme and LeFF string encryption from separate samples. [2] The same assembled-from-parts pattern holds on the controller side: analysis of the leaked source shows the “fancy GUI” is a VB.NET application (pervasive Microsoft.VisualBasic runtime usage — decompiled here to C#) that wires together off-the-shelf libraries — BouncyCastle (crypto), NAudio (audio capture/encoding), Newtonsoft.Json, and four third-party UI control packs (ObjectListView, VisualPlus, Zeroit, and the commercial SkinSoft VisualStyler skin) — the managed-code analogue of the payload’s Boost/libcurl/OpenCV assembly. User-facing strings ship with spelling errors (“confimrations,” “alrgorithm”), and the leaked build reports version ~1.27, an early 1.x with no major-version evolution. Crucially, pasting is category-wide: AsyncRAT reuses Quasar’s Aes256/Sha256 cryptography classes essentially unmodified, including the same salt — a link researchers use to tie the two together. [4] BitRAT is therefore not distinguishable from the open-source ecosystem by originality; it is the same practice, behind a (since-removed) paywall.

7. Operational viability and obsolescence

Criminal viability is ultimately demonstrated by adoption and durability, not by a feature list. On this axis BitRAT is weak and, as of this writing, effectively dormant.

Low cost, commodity positioning. BitRAT sold for $20 for lifetime access — a price point that signals commodity, not premium, tooling and that undercuts any “sophisticated commercial malware” framing. [9]

À-la-carte feature monetisation (leaked-source analysis). The controller monetises capabilities as separate purchases: alongside the base license form, the source contains dedicated in-app cryptocurrency payment dialogs for HVNC and DDoS (fPaymentHVNC, fPaymentDDoS), which unlock those features as individually purchased add-ons once a crypto payment confirms — distinct from the HWID-locked base license. In other words, BitRAT’s own vendor treated HVNC and DDoS as paywalled upsell SKUs. This is significant for classification: the very capabilities gated behind BitRAT’s paywall are handed out for free by the open-source ecosystem (VenomRAT/XWorm HVNC and DDoS; DCRat/XWorm ransomware). The distinction between BitRAT and the open-source RATs on these features is therefore purely one of monetisation and packaging — not capability, availability, or sophistication — which is precisely the variable that drives the “crimeware” label.

A short active window, with visible decline. Documented real-world use concentrates in 2021–2022: Blind Eagle / APT-C-36 spear-phishing against Colombian and other Latin American banking targets, a March 2022 campaign using a pirated Windows 10 activator lure, and phishing using data stolen from a Colombian cooperative bank. [8][9][10] Even during this window the operation was visibly deteriorating: the sale thread shows the license server repeatedly crashing under “too many concurrent logins and attacks,” a cracked build circulating publicly by mid-2022, and buyers openly citing “threads on how BitRAT is dead” (Appendix A).

Vendor retirement and permanent shutdown (documented — Appendix A). On 23 Jan 2023, the seller “UnknownProducts” posted a retirement notice in the sale thread — “I’m shortly leaving the scene due to lack of time maintaining this project and the need to move forward with my life” — soliciting a buyer to take the project over and stating, in the vendor’s own words, that “should I not find a suitable and trustable person to take over this project, then it will be made open source.” The infrastructure went permanently offline in March 2023, with buyers reporting “Server down from Morning” (22 Mar 2023) and “server still down? just bought” (26 Mar 2023). This is first-party confirmation of abandonment, not inference.

Source publicly available since 2020 (pre-leak). BitRAT’s source was published to GitHub (the Snykes repository) in 2020 — the same year it went on sale and was first analysed by Krabs. This was an unauthorised leak, not the vendor’s own release: it predates UnknownProducts’ January 2023 retirement post by ~3 years, which is why that post still frames open-sourcing as a future contingency (“will be made open source”) — the seller was either unaware of, or ignoring, a leak that had already happened. The consequence for classification is decisive: BitRAT’s source was as freely available as AsyncRAT’s or Quasar’s for its entire commercial life. The “closed, for-sale” model was never real exclusivity — buyers paid $20 for the vendor’s official builds and licensing/support of a codebase anyone could already pull from GitHub (and a cracked binary was circulating by ~2022 as well). BitRAT was, in effect, an open-source RAT with a paywall bolted onto the vendor’s build service; it is now simply frozen at its final version (~1.27), with no active maintenance or fork ecosystem. [10]

Not tracked in community telemetry. ANY.RUN’s Malware Trends Tracker — which surfaces families by live community sandbox submissions — returns no results for BitRAT, i.e. it is not maintained as a distinct trending family. By contrast, contemporaries that are themselves discontinued remain listed: WarZone RAT (its vendor domain seized/delisted in 2023) and MassLogger (2020-era) both appear in the tracker’s rankings. BitRAT is thus less represented in the current threat ecosystem than tools that have also been shut down. [21]

The composite picture is a cheap, briefly used, now-defunct tool whose closed-source status has lapsed — the opposite of a durable, high-viability crimeware platform.

8. Evasion and crypter viability

Even during its active window, BitRAT was poorly suited to the task that determines whether a RAT survives contact with a defended endpoint: evading the static and behavioural detection that ships by default on modern Windows.

Forced UPX packing (author’s observation). BitRAT builds were delivered UPX-packed. UPX is a compressor, not a crypter: it is open-source, leaves distinctive UPX0/UPX1 section names and elevated entropy that signature engines key on, and is reversed automatically with a single upx -d (or trivially by any sandbox’s unpacking stage). It provides essentially no defeat of static AV/EDR signatures and no anti-analysis value. [27] A build pipeline that ships UPX-packed output — rather than leaving stubs lean for the operator to crypt/obfuscate properly — actively handicaps evasion.

Stub bloat and noisy artefacts (author’s observation, partially corroborated). BitRAT stubs ran ~1.9 MB packed, and the Tor variant ~5 MB because it drops the entire Tor binary to disk — the latter independently confirmed by KrabsOnSecurity, who noted dropping the Tor binary is something “no competent malware developer would do.” [1] Large, high-entropy binaries that write a recognisable Tor executable to disk are conspicuous to both static scanning and behavioural monitoring.

Net effect. Against the stock Windows Defender baseline present on every modern host — before any paid EDR is added — a forced-UPX, multi-megabyte, Tor-dropping stub is a weak intrusion vehicle. By comparison, the open-source RATs’ lean .NET stubs are readily processed by the mature, actively developed crypter/obfuscator ecosystem that surrounds them (indeed several forks, e.g. DCRat, build in AMSI/ETW patching). On the practical metric of “can this be delivered past default defences,” BitRAT is inferior to its open-source alternatives — a capability-independent viability deficit.

Build pipeline (analysis of the leaked 2020 controller source). The leaked source explains why BitRAT’s output is uniformly packed and bloated: in this version the stub is built client-side by the controller’s Builder form (fBuilder), which offers only “Standard” and “Tor” output options — a mapping that matches the documented config format’s tor fields. The stub templates and the Tor binary are not compiled at build time; they ship prebuilt inside the controller as embedded resources (the GUID-named EmbeddedResource blobs in BitRAT.csproj; the ~1.1 MB and ~877 KB blobs are the stub templates, with a ~461/441/381 KB cluster consistent with tor.exe plus geoip data), stored encrypted and deflate-compressed (a common obfuscator envelope, decrypted then inflated via a DeflateStream in the readable extractor class). At build time the operator’s configuration is stamped into a prebuilt template — consistent with OALABS’ finding that BitRAT patches its configuration into the binary post-compilation by replacing strings — and the Tor variant writes the bundled Tor binary to disk, which KrabsOnSecurity independently confirmed. [1][2] The operational consequence is that the operator has no control over packing: every build emerges as the same prebuilt, UPX-packed, multi-megabyte (Tor: ~5 MB, Tor-dropping) shape, with no option to substitute a stronger crypter or produce a lean stub for external crypting. A tool that hard-codes a trivially reversible packer into a fixed template and denies the operator any crypting flexibility is, by construction, a poor delivery vehicle against the default endpoint baseline — reinforcing the viability deficit above from the build side, not merely the output side.

Scope and verification note. The build routine that performs the packing (fBuilder‘s background-worker method) is itself virtualized: it dispatches into the same code-virtualization runtime that protects the rest of the controller (a loader class instantiates the VM engine and feeds it an encrypted bytecode resource; the build method is a thin call into that VM). Consequently, the exact packer invocation and command-line flags are not present in readable source and were not independently recovered for this report; they reside in the virtualized builder bytecode. The packing behaviour (UPX-packed output; ~1.9 MB standard / ~5 MB Tor stubs; Tor binary dropped to disk) rests on the report author’s first-hand analysis of BitRAT build artefacts, corroborated where noted by KrabsOnSecurity and OALABS. Recovering the literal packer command would require devirtualising the builder — out of scope here — and any such claim about specific flags should be marked accordingly until independently reproduced.

9. Matrix 3 — RATs vs. a real crimeware platform (DanaBot)

The axes that actually define crimeware viability are operational, not featural.

Reading. DanaBot’s viability is a property of how it is run: a rental economy, custom tooling, resilient signed infrastructure, integrated fraud and ransomware delivery, and a footprint large enough to warrant an international takedown. BitRAT — and equally a compiled VenomRAT or XWorm — is a commodity utility with none of that apparatus. The gap between the RAT tier and the crimeware tier dwarfs any intra-RAT gap between “closed and sold” and “open and free.”

10. Discussion

Capability does not favour BitRAT. Corrected for its miner/DDoS/clipper, BitRAT is at parity with the open-source ecosystem and lacks the ransomware and self-propagation that free forks provide, with cruder evasion. A defender ranking BitRAT above AsyncRAT/Quasar because it was a paid product has the risk backwards.

Provenance undercuts the “sophisticated commercial malware” framing — and is category-wide. A tool whose every notable component is pasted from TinyNuke, legacy crypters, and Stack Overflow required no offensive engineering; two independent analyses confirm this. Because the open-source RATs also assemble from shared, copied components (AsyncRAT ← Quasar crypto), “built from pasted parts” does not separate BitRAT from the free ecosystem.

Operational evidence makes BitRAT the weaker tool. This is the decisive addition. BitRAT was cheap ($20 lifetime), briefly adopted (2021–22), then abandoned — its vendor gone by March 2023, its source public on GitHub since 2020 (its launch year), and it is not even carried as a trending family by ANY.RUN while discontinued peers still are. Its forced-UPX, multi-megabyte, Tor-dropping stubs made it a poor delivery vehicle against the default Windows Defender baseline, whereas the lean open-source stubs sit inside a mature crypter/obfuscator ecosystem and some forks build modern evasion in. On the metrics that decide whether a tool actually works in an intrusion, BitRAT underperforms its free alternatives.

The classification divergence is explained by distribution model — which was never even real. The one axis on which BitRAT ostensibly differed from AsyncRAT/Quasar was closed, for-sale distribution on a criminal marketplace — precisely the variable that industry and law-enforcement labelling respond to. But that exclusivity was illusory: BitRAT’s source was leaked to GitHub in 2020, its launch year, so it was as openly available as AsyncRAT and Quasar for essentially its entire existence. The “closed” label described the vendor’s storefront, not the code’s availability. Researchers have explicitly noted that the line between “remote-access tool” and “remote-access trojan” here is drawn by who sells it and how they are paid, not by what the code does. [14]

Addressing the strongest counterargument. The most defensible objection remains the stock-comparison delta (Matrix 1): BitRAT is more feature-complete than upstream AsyncRAT/Quasar. This is conceded and does not rescue “more criminally viable,” because (a) those capabilities are freely available in the open-source forks that define the category’s real ceiling — BitRAT introduces nothing the ecosystem lacks; (b) the implementations are pasted, not engineered; and (c) capability is moot where delivery fails, and BitRAT’s evasion posture and abandonment make it the less deliverable, less durable option.

Limitations. This is a capability, provenance, and viability assessment, not a victim-impact study. The vendor-shutdown timeline is now documented from primary screenshots (Appendix A). Two operational specifics remain author-attributed — builder-enforced UPX packing and the ~1.9/5 MB stub sizes — and should be verified against the catalogued samples (Appendix B) before external publication. The build-pipeline finding (Section 8) is drawn from the leaked controller source, but the packing routine is virtualized, so the exact packer command/flags were not recovered and any specific-flag claim should be marked as unverified until independently reproduced (e.g. by devirtualising the builder). Feature availability drifts as forks and BitRAT versions evolve; matrices reflect the referenced analyses and should be refreshed against current samples.

11. Conclusion

BitRAT is closed-source and was sold, and it is correctly identified as malware. But “closed and for sale” describes a commercial model, not criminal potency. On capability BitRAT is at parity with — and in ransomware/propagation and modern evasion, behind — the open-source AsyncRAT/Quasar ecosystem. On originality it contributes nothing, a fact two independent analyses confirm and one shared with the open-source RATs themselves. On the operational axes that decide real-world viability — deliverability past default defences, adoption, and longevity — it is the weaker tool: poorly crypted, briefly used, and defunct since March 2023, its source public since 2020 and now frozen. And against a genuine crimeware platform such as DanaBot it is not remotely comparable.

The evidence therefore supports, and strengthens, the report’s thesis: BitRAT is not a more criminally viable tool than its open-source alternatives — and by the operational measures that matter, it is less so. Its “crimeware” designation was driven by a distribution model that has since lapsed; a capability-, provenance-, and viability-based assessment places it firmly within (and toward the lower end of) the open-source RAT tier, far below the crimeware tier occupied by tools whose viability is proven by criminal operation at scale.

References

[1] KrabsOnSecurity, “BitRAT – The Latest in Copy-Pasted Malware by Incompetent Developers,” 22 Aug 2020. https://krabsonsecurity.com/2020/08/22/bitrat-the-latest-in-copy-pasted-malware-by-incompetent-developers/

[2] OALABS Research, “BitRat Exposed,” 20 Oct 2022. https://research.openanalysis.net/ (BitRAT config-extraction and string-encryption analysis)

[3] AsyncRAT (NYAN-x-CAT), GitHub repository README. https://github.com/NYAN-x-CAT/AsyncRAT-C-Sharp

[4] ESET Research (WeLiveSecurity), “Unmasking AsyncRAT: Navigating the labyrinth of forks,” 2024. https://www.welivesecurity.com/en/eset-research/unmasking-asyncrat-navigating-labyrinth-forks/ (DCRat file-encryption/AMSI-ETW; AsyncRAT↔Quasar crypto reuse); The Hacker News summary, 15 Jul 2025. https://thehackernews.com/2025/07/asyncrats-open-source-code-sparks-surge.html

[5] CISA, “Quasar Open-Source Remote Administration Tool” (AR18-352A), 2019. https://www.cisa.gov/news-events/analysis-reports/ar18-352a

[6] Malpedia (Fraunhofer FKIE), “BitRAT (win.bit_rat).” https://malpedia.caad.fkie.fraunhofer.de/details/win.bit_rat (capabilities: DDoS, clipboard monitoring, webcam, credential theft, audio, XMRig mining, keylogging)

[7] Hack Forums marketplace listing, “#1 BitRAT – SSL/TOR | C++ | KEYLOGGER | HIDDEN BROWSER | XMR MINER | PASSWORDS | hVNC,” 2020. (vendor advertisement; XMRig miner and hVNC advertised)

[8] The Hacker News, “Blind Eagle Hackers Return with Refined Tools and Sophisticated Infection Chain,” 7 Jan 2023. https://thehackernews.com/2023/01/blind-eagle-hackers-return-with-refined.html (APT-C-36 BitRAT campaigns; Qualys Colombian-bank lure)

[9] The Register, “Watch out for phishing emails that inject spyware trio,” 1 Jun 2022. https://www.theregister.com/2022/06/01/phishing-rat-bitrat-fortinet/ ($20 lifetime price per Bitdefender; pirated-Windows-activator campaign)

[10] Snykes, “BitRat-Source-Code,” GitHub. https://github.com/Snykes/BitRat-Source-Code (unauthorised public source-code leak of BitRAT; repository dates to 2020 per its commit history — i.e. a pre-leak predating the vendor’s 2023 shutdown, confirmed from repository metadata by the report author)

[11] Derp.ca, “Quasar RAT Malware Profile.” https://www.derp.ca/quasar/

[12] Lumu Technologies, “QuasarRAT (S0262).” https://lumu.io/resources/threat-glossary/quasarrat/

[13] Hunt.io, “VenomRAT: Windows Remote Access Trojan Analysis.” https://hunt.io/malware-families/venomrat (HVNC module added v5.6; ransomware/encryption)

[14] Cyberint, “Venom Control – RAT With a Sting,” 23 Oct 2023. https://cyberint.com/blog/research/venom-control-rat-with-a-sting/ (HVNC in VenomRAT and BitRAT; RAT-vs-trojan classification by distribution)

[15] Cyble, “Venom RAT Expands Its Operations by Adding a Stealer Module,” 21 May 2025. https://cyble.com/blog/venom-rat-expands-its-operations-by-adding-a-stealer-module/

[16] Cofense, “The Rise of XWorm RAT.” https://cofense.com/blog/the-rise-of-xworm-rat-what-cybersecurity-teams-need-to-know-now (DDoS, USB spread, clipper, ransomware, HVNC); Cofense, “Hidden in the Crowd: The Risk of Group-Delivered Malware,” 6 Nov 2024. https://cofense.com/blog/hidden-in-the-crowd-the-risk-of-group-delivered-malware

[17] Proofpoint, “A Brief History of DanaBot, Longtime Ecrime Juggernaut Disrupted by Operation Endgame,” 22 May 2025. https://www.proofpoint.com/us/blog/threat-insight/brief-history-danabot-longtime-ecrime-juggernaut-disrupted-operation-endgame

[18] ESET Research (WeLiveSecurity), “Danabot: Analyzing a fallen empire,” 22 May 2025. https://www.welivesecurity.com/en/eset-research/danabot-analyzing-fallen-empire/

[19] Proofpoint, “DanaBot Malware: New Year, New Version,” 20 Oct 2023. https://www.proofpoint.com/us/blog/threat-insight/new-year-new-version-danabot

[20] Microsoft Security Intelligence, “Trojan:Win32/Danabot.” https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FDanabot ; BlackBerry, “Threat Thursday: DanaBot,” 19 Nov 2021. https://blogs.blackberry.com/en/2021/11/threat-thursday-danabot-malware-as-a-service

[21] ANY.RUN, Malware Trends Tracker. https://any.run/malware-trends/ (BitRAT: no tracked family / no results; WarZone RAT and MassLogger present in rankings — as captured 2026)

[22] U.S. Department of Justice, Central District of California, “16 Defendants Federally Charged in Connection with DanaBot Malware Scheme That Infected Computers Worldwide,” 22 May 2025. https://www.justice.gov/usao-cdca/pr/16-defendants-federally-charged-connection-danabot-malware-scheme-infected-computers (16 defendants; Stepanov “JimmBee” and Kalinkin “Onix” of Novosibirsk; 300,000+ victims; $50M+ damage; ransomware and espionage-variant botnet; DCIS C2 seizures; grand-jury indictment filed 20 Sept 2022)

[23] Hackread / Europol summary, “Operation Endgame Takes Down DanaBot Malware, Neutralizes 300 Servers,” 23 May 2025. https://hackread.com/operation-endgame-danabot-malware-neutralizes-servers/ (≈300 servers, 650 domains, 20 arrest warrants, €21.2M total Endgame seizures; SCULLY SPIDER espionage variant; ESET-observed DDoS on Ukraine MoD; partner agencies and firms)

[24] Intel 471, “DanaBot malware disrupted, threat actors named,” 2025. https://www.intel471.com/blog/danabot-malware-disrupted-threat-actors-named (indictment filed CDCA 20 Sept 2022; tiered MaaS pricing introduced 10 July 2023; 9+ loader updates 2023–May 2025; custom cryptor preview 2 May 2025; operator aliases)

[25] Help Net Security, “DanaBot botnet disrupted, QakBot leader indicted,” 23 May 2025 (updated 11 Jun 2025). https://www.helpnetsecurity.com/2025/05/23/operation-endgame-danabot-botnet-disrupted-qakbot-leader-indicted/ (Operation Endgame coordination by Europol/Eurojust; US/Canada/EU; CrowdStrike political-nexus assessment; Zscaler C2-vulnerability visibility)

[26] Security Boulevard, “U.S. Authorities Seize DanaBot Malware Operation, Indict 16,” 24 May 2025. https://securityboulevard.com/2025/05/u-s-authorities-seize-danabot-malware-operation-indict-16/ (affiliate access leased at $3,000–$4,000/month; infrastructure breakdown: distribution, backend, C2, and proxy servers)

[27] On UPX as a compressor rather than a crypter, and its trivial/automated reversal (upx -d, distinctive UPX0/UPX1 sections, high entropy): UPX project, https://upx.github.io/ ; see also Akamai, “UPX Packed Headaches,” 2025. https://www.akamai.com/blog/security/upx-packed-headaches

Appendix A — Vendor shutdown timeline (primary evidence)

Captured from the HackForums sale thread “#1 BitRAT – SSL/TOR | C++ | KEYLOGGER | HIDDEN BROWSER | XMR MINER | PASSWORDS | hVNC” (seller: UnknownProducts, forum: Premium Tools and Programs). Screenshots on file with the author; quotations transcribed below. This documents the obsolescence and abandonment claims (§1.4, §7) as first-party primary evidence rather than inference.

Notes. (1) The retirement post’s own feature banner lists: Remote Desktop, Webcam live feed, File manager, Keylogger, Audio live feed, Remote browser (HVNC), XMR Miner, Password recovery, Reverse proxy, “50+ more features” — first-party corroboration of the Matrix 1 capability set. (2) The same post requests a successor with “experience with C# .Net and deeper knowledge in C++,” confirming the two-component (managed controller + native payload) architecture; note the decompiled controller is VB.NET (see §6), a discrepancy with the vendor’s “C# .Net” phrasing. (3) The vendor’s stated intent to open-source is not the origin of the public source: the Snykes GitHub repository dates to 2020 (confirmed from repository metadata by the author) — an unauthorised pre-leak predating this 2023 retirement post by ~3 years, which is why the post still frames open-sourcing as a future possibility. To finalise: attach the dated screenshots; the source-publication date is confirmed as 2020.

Appendix B — Sample catalogue (packing/size evidence)

SHA-256 hashes published in the KrabsOnSecurity analysis (2020) [1]. The first is the primary analysed sample; per Krabs it was built with Visual Studio 2015 (Build 14.0.24215) on 14 Aug 2020 and independently referenced by OALABS (2022) [2]. The measured-property columns back the §8 packing/size claims and should be populated from the analyst’s own tooling (e.g. pefile/die/entropy + upx -t) before publication; they are intentionally left blank rather than asserted here.

Verification checklist per sample. (a) file / DIE → confirm PE + detected packer; (b) section table → presence of UPX0/UPX1; (c) overall entropy (packed binaries trend >7.0); (d) upx -t / upx -d → confirms reversibility, the crux of §8’s “no static-evasion value”; (e) record on-disk size (expected ~1.9 MB standard; ~5 MB for the Tor build that drops tor.exe to disk); (f) note whether tor.exe/torrc artefacts are dropped at runtime (Tor variant). Populating (b)–(e) converts §8’s UPX/size claims from author-attributed to independently verifiable.