Detecting Remote Access Trojan (RAT) Attacks based on Different LAN Analysis Methods

Abstract

Cyberattacks aim to access confidential information or disrupt system functionality. These days, they can take the form of attacks that give the attacker complete control over the victim's computer. Remote Access Trojans (RAT) are malware designed for these purposes. RAT gives an attacker direct access to a victim's computer and allows him to interact with the victim to steal confidential information, spy on him in real time, or interact directly with him through a dialogue box. RATs are used for information theft, surveillance, and extortion of victims. This study installed multiple virtual machines as a prototype for both the attacker and the victim, interconnected on a Local Area Network (LAN). RAT installations were explored using Mega RAT version 1.5 Beta. Ultimately, various RAT attacks were executed on target machines, and a range of static and dynamic analysis tools were employed to identify RAT. The scenarios implemented on the LAN demonstrated that RATs can be built and used with ease. Furthermore, their attacks can be identified through static or dynamic analysis using various freely available tools. The findings show that the static detection approach to identify RAT malware is more user-friendly compared to dynamic methods. However, dynamic detection can be easily performed using cost-free software.