S400 RAT

This RAT combines multiple attack techniques such as credential theft, cryptocurrency mining, clipboard hijacking, and self-propagation.
Client & Connection Management allows attackers to manually configure IP addresses and ports to establish direct communication with infected machines.
Installation & Persistence adds itself to Windows startup so it runs automatically after every reboot.
Security Evasion & System Manipulation, the malware adds itself to the exclusion list or disables Defender entirely. This prevents scanning and automatic removal.
Cryptocurrency Miner, the malware secretly uses CPU/GPU power to mine cryptocurrency like Monero.
Clipboard Hijacker (Clipper) feature continuously scans copied text for cryptocurrency wallet addresses.
Password & Data Theft, extracts saved usernames and passwords from popular browsers.
Builder & Payload Configuration, attackers can assign names and configure behavior before deployment. This allows targeted and flexible attacks.
Binder & Assembly Cloning, combines malware with legitimate files like software or documents. Users unknowingly execute malware along with the file.
Spreading Mechanisms, copies itself to removable drives and spreads across systems. This enables offline propagation.
Monitoring & Remote Control, displays infected systems with detailed information. Allows centralized control over multiple victims.
The UAC Bypass module focuses on privilege escalation techniques that help malware gain elevated acces
Victim Profiling, collects system specifications and operating system data. Helps attackers tailor further attacks.