The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Yes. In 2017, Zscaler ThreatLabZ reported that a Cobian RAT builder advertised for free contained a hidden backdoor. Payloads made with the kit could use command-and-control information controlled by the kit’s original author, potentially giving that author control over systems operated by people who had downloaded and used the builder.
What was Cobian RAT?
Cobian RAT was a remote-access trojan (RAT): malware designed to let an operator monitor or control a compromised computer remotely. SecurityWeek’s 2017 reporting described features including keylogging, screen and webcam capture, voice recording, file browsing, a remote command shell, password theft, and the ability to run files or scripts. The feature set also included dynamic plugins, software installation and removal, updates to a command-and-control (C&C) server list, and persistence—methods intended to keep the malware active after a restart. SecurityWeek also reported stress-testing and flood-attack functions.
These capabilities describe what the malware could do, not proof that every infected computer was subjected to every function. The reporting does not establish how many people used the builder or how many systems were infected.
How could the original author control systems built by other operators?
The builder was intended for downstream operators to generate and spread their own Cobian RAT payloads. But Zscaler ThreatLabZ reported that the kit also included a concealed module that retrieved C&C information from a predetermined URL controlled by the original author. That gave the author a way to change the control information used by payloads made with the backdoored builder.
Recommended Free Tools
#1 Best Overall
In effect, the operators who spread those payloads could create separate botnets while the kit’s author retained a route to influence or take control of them. Zscaler described the arrangement as a “crowdsourced” model for building a larger botnet. Free access therefore did not mean independent or trustworthy operation: the builder itself embedded a second layer of control.
How was the observed payload delivered and kept active?
Zscaler documented one sample delivered inside a ZIP archive that masqueraded as a Microsoft Excel spreadsheet. The archive was served from a website described as a potentially compromised Pakistan-based defense and telecommunications site. That observation concerns the reported sample; it does not establish that every Cobian RAT infection used the same delivery route.
The sample’s execution chain included several concealment and persistence features:
- Misleading certificate: The executable had an invalid certificate that impersonated VideoLAN.
- Packing and encryption: It used .NET packing and stored an encrypted payload in its resources.
- Analysis resistance: It checked for debugging activity and used a mutex, a named object that can help prevent multiple instances from running.
- Temporary copy: It copied itself to
%TEMP%/svchost.exe. - Startup persistence: It added an autostart registry entry. Zscaler’s account does not identify the specific registry key, so a more exact path should not be inferred from this report.
What should you do if you suspect a Cobian RAT infection?
If a suspicious archive or executable was opened, treat the device as potentially compromised. A RAT may expose credentials and allow remote activity, so focus on containment and recovery rather than trying to inspect or interact with the malware yourself.
- Isolate the device. Disconnect it from Wi-Fi or wired networks to limit further communication. If it is a work device, contact your IT or security team promptly and follow its incident process.
- Use a trusted security tool or incident-response professional. Run an up-to-date endpoint security scan, or have the device examined by qualified responders. Do not rely on deleting a suspicious file alone: the reported sample used persistence and could copy itself to a temporary location.
- Change exposed credentials from a clean device. Prioritize email, work, financial, and administrator accounts. Revoke active sessions where possible and enable multifactor authentication. If a work account may be involved, coordinate changes with the organization’s security team.
- Restore only after the device is assessed. Follow the security tool’s remediation guidance or your organization’s incident-response advice. For a serious compromise, a clean operating-system reinstall from trusted media may be safer than attempting manual cleanup.
How can you reduce the risk from a backdoored builder?
Do not run a RAT builder or payload merely because it is offered free, is described as a security tool, or appears to come from a familiar source. For defensive users, the safest course is not to download or execute malware builders. For organizations, layered controls can reduce the chance that a disguised payload runs and help limit damage if one does:
- Block or quarantine unexpected executable content arriving in archives, especially when the file type or contents do not match the sender’s explanation.
- Keep endpoint protection, operating systems, and applications updated, and investigate alerts involving unexpected startup entries or executables in temporary folders.
- Use least-privilege accounts for routine work, maintain reliable backups, and have a process for isolating suspected devices and resetting potentially exposed credentials.
- Train users to verify unexpected attachments through a separate trusted channel rather than opening them based on a spreadsheet-like filename or icon.
Zscaler’s 2017 technical analysis and SecurityWeek’s reporting document the backdoor and capabilities described here. They do not establish a current prevalence estimate, a victim count, or a guarantee that any single defensive measure will detect every RAT variant.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
