Reply to thread

Message

<blockquote data-quote="Trident" data-source="post: 1049692" data-attributes="member: 99014">Yeah, and most RATs contain stealing functionalities as well that can be triggered with a few clicks. But RATs in general are much more difficult to develop, they require more complex architecture and backend, and maintaining evasion over time is more difficult (not impossible, specially when there is paying clientele).Stealers have very little to do, so it is possible to change the way you do it much more frequently (playing with API calls, directories, fragmenting the functionality amongst others), thus escaping behavioural blocking much easier. All pre-execution blocks can easily be evaded by using a custom or unusual packer and cloud-based analysis can be evaded via packing junk together with the malicious executable.On runtime, because everything happens too quick as pointed out earlier by [USER=59691]@Kongo[/USER] , by the time blocking and remediation are initiated, data may have already been sent over. When that happens, you are screwed.</blockquote>

[QUOTE="Trident, post: 1049692, member: 99014"] Yeah, and most RATs contain stealing functionalities as well that can be triggered with a few clicks. But RATs in general are much more difficult to develop, they require more complex architecture and backend, and maintaining evasion over time is more difficult (not impossible, specially when there is paying clientele). Stealers have very little to do, so it is possible to change the way you do it much more frequently (playing with API calls, directories, fragmenting the functionality amongst others), thus escaping behavioural blocking much easier. All pre-execution blocks can easily be evaded by using a custom or unusual packer and cloud-based analysis can be evaded via packing junk together with the malicious executable. On runtime, because everything happens too quick as pointed out earlier by [USER=59691]@Kongo[/USER] , by the time blocking and remediation are initiated, data may have already been sent over. When that happens, you are screwed. [/QUOTE]

Verification