DISCLAIMER: This repository is for educational and security research purposes only. DynamicRAT is a functional malware family.
This repository contains a reconstructed and buildable version of DynamicRAT's client. Originally discovered in ~2024, DynamicRAT is Java-based Remote Access Trojan targeting governmental agencies through tax-themed phishing campaigns. It was also seen trying to infect Minecraft players, and was used for many different social-engineering attacks.
The goal of this project is to provide a transparent look at DynamicRAT's internal mechanics, to help with identifying other malware.
This RAT is exceedingly interesting to me as it is one of the most advanced RAT's I've seen in Java yet, it also has an extensive feature set. The HVNC really piqued my interest.
- HVNC: This is the "crown jewel" of DynamicRAT. It allows an operator to spin up a completely invisible desktop session, seeing and controlling the victim's screen without them noticing a thing.
- The ability to ddos Minecraft Servers: This isn't the first time I've seen this, I had also spotted it on "Kutusov Botnet", a botnet targetting specifically spanish Minecraft players, but this is the most advanced example.
- Stealth Tactics: DynamicRAT hides in plain sight by naming it's files and registry keys after common programs. (such as Notepad++)
I cannot stress this enough, do not run this outside of a VM. I tried to keep it as unchanged as I possibly could, so that other researchers could learn from this. Many of the libraries were also altered in some way, which is why I've included some in the src itself. Not ideal, but it is needed.