[5265Star][1m] [Py] n1nj4sec/pupy Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python

Covenant

[1147Star][6d] [C#] cobbr/covenant Covenant is a collaborative .NET C2 framework for red teamers.
[95Star][9d] [C#] cobbr/elite Elite is the client-side component of the Covenant project. Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.
[31Star][4m] [C#] cobbr/c2bridge C2Bridges allow developers to create new custom communication protocols and quickly utilize them within Covenant.

Slackor

[332Star][12d] [Py] coalfire-research/slackor A Golang implant that uses Slack as a command and control server

QuasarRAT

[2932Star][10m] [C#] quasar/quasarrat Remote Administration Tool for Windows

EvilOSX

[1376Star][2y] [Py] marten4n6/evilosx An evil RAT (Remote Administration Tool) for macOS / OS X.

Merlin

[2568Star][6m] [Go] ne0nd0g/merlin Merlin is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in golang.

Commercial Tools

Team Viewer

[405Star][2y] [C++] vah13/extracttvpasswords tool to extract passwords from TeamViewer memory using Frida
[277Star][2y] [C++] gellin/teamviewer_permissions_hook_v1 A proof of concept injectable C++ dll, that uses naked inline hooking and direct memory modification to change your TeamViewer permissions.
[175Star][9d] uknowsec/sharpdecryptpwd 对密码已保存在 Windwos 系统上的部分程序进行解析,包括：Navicat,TeamViewer,FileZilla,WinSCP,Xmangager系列产品（Xshell,Xftp)。
[59Star][2y] [Py] attackercan/teamviewer-dumper Dump TeamViewer ID and password from memory. Works much better than other tools.
[42Star][6d] [C#] v1v1/decryptteamviewer Enumerate and decrypt TeamViewer credentials from Windows registry
[36Star][5y] [C++] kkar/teamviewer-dumper-in-cpp Dumps TeamViewer ID,Password and account settings from a running TeamViewer instance by enumerating child windows.
[25Star][5m] [C++] dydtjr1128/remoteassistance-cpp [WIP]RemoteAssistance like TeamViewer(C++)

RAT Malware

Gh0st

[301Star][7d] [C++] yuanyuanxiang/simpleremoter RAT based on gh0st
[273Star][7y] [C++] sin5678/gh0st a open source remote administrator tool
[91Star][6y] [C++] igh0st/gh0st3.6_src
[90Star][1m] [C++] zibility/remote 参考Gh0st源码，实现的一款PC远程协助软件，拥有远程Shell、文件管理、桌面管理、消息发送等功能。
[21Star][5m] [C++] holmesian/gh0st-light 精简之后的老东西

NanoCore

[2Star][10m] [Py] jacobpimental/nanocore_extractor Extracts nanocore sample from compile AutoIT script

NjRat

[143Star][2y] [Visual Basic .NET] alibawazeeer/rat-njrat-0.7d-modded-source-code NJR
[128Star][8d] [Visual Basic] mwsrc/njrat njRAT SRC Extract
[14Star][5m] [C#] nyan-x-cat/njrat-0.7d-stub-csharp njRAT C# Stub - Fixed For PowerShell
[3Star][2y] [Py] seep1959/njutils A client and chat program for njrat 0.6.4, 0.7d, and 0.7d golden edition.

Revenge RAT

[21Star][2m] [C#] nyan-x-cat/revengerat-stub-cssharp Revenge-RAT C# Stub - Fixed

PlugX

[28Star][7y] [Py] kcreyts/plugxdecoder Decodes PlugX traffic and encrypted/compressed artifacts

RemcosRAT

L0rdixRAT

LodaRAT

2020.02 [talosintelligence] Loda RAT Grows Up

GulfRAT

NetWireRAT

JhoneRAT

Dacls

BlackRemote

Orcus

NukeSped

DarkComet

WarZone RAT

BlackShades

DenesRAT

WSH RAT

Qrypter RAT

Adwind

CannibalRAT

2018.02 [talosintelligence] CannibalRAT targets Brazil

jRAT

jsRAT

CrossRat

ArmaRat

RokRAT

CatKARAT

TheFatRat

OmniRAT

LuminosityLink

Other

Pubic Service For C&C

[648Star][1y] [Py] mehulj94/braindamage Remote administration tool which uses Telegram as a C&C server
[330Star][8m] [Py] mvrozanti/rat-via-telegram Windows Remote Administration Tool via Telegram
[160Star][4y] [Py] blazeinfosec/bt2 Blaze Telegram Backdoor Toolkit is a post-exploitation tool that leverages the infrastructure of Telegram as a C&C

Twitter

[658Star][4y] [Py] paulsec/twittor A fully featured backdoor that uses Twitter as a C&C server
[186Star][3y] [Go] petercunha/goat a trojan created in Go, using Twitter as a the C&C server

GMail

[1117Star][1y] [Py] byt3bl33d3r/gcat A PoC backdoor that uses Gmail as a C&C server
[353Star][3y] [Py] maldevel/gdog A fully featured Windows backdoor that uses Gmail as a C&C server
[22Star][1y] [Py] pure-l0g1c/keylogger A simple keylogger that uses Gmail as a C&C

Github

[179Star][3y] [Py] maldevel/canisrufus A stealthy Python based Windows backdoor that uses Github as a command and control server

DropBox

[134Star][1y] [Py] 0x09al/dropboxc2c DropboxC2C is a post-exploitation agent which uses Dropbox Infrastructure for command and control operations.

Blockchain

[46Star][1y] [Go] xpn/blockchainc2 A POC C2 server and agent to explore just if/how the Ethereum blockchain can be used for C2
[35Star][3m] [Py] geek-repo/c2-blockchain This is a concept poc of command and control server implemented over blockchain

Other

[513Star][1y] [Go] mthbernardes/gtrs uses Google Translator as a proxy to send arbitrary commands to an infected machine
[102Star][4m] [Py] nccgroup/gitpwnd GitPwnd is a network penetration tool that lets you use a git repo for command and control of compromised machines
[97Star][2y] [Py] arno0x/webdavc2 A WebDAV PROPFIND C2 tool
[93Star][2y] [PS] bkup/slackshell PowerShell to Slack C2
[84Star][2y] [Go] 0x09al/browser-c2 Post Exploitation agent which uses a browser to do C2 operations.
[69Star][13d] [Py] itskindred/redviper redViper is a proof of concept Command & Control framework that utilizes Reddit for communications.
[66Star][2y] [Py] lukebaggett/google_socks A proof of concept demonstrating the use of Google Drive for command and control.
[29Star][2y] [Py] ajinabraham/xenotix-xbot Xenotix xBOT is a Cross Platform PoC Bot that abuse certain Google Services to implement it’s C&C
[26Star][3y] [Py] dsnezhkov/octohook Git Web Hook Tunnel for C2
[23Star][10d] [PS] netspi/sqlc2 SQLC2 is a PowerShell script for deploying and managing a command and control system that uses SQL Server as both the control server and the agent.
[22Star][2y] [Py] woj-ciech/social-media-c2 Script is a proof of concept how to control your machine by using social media sites.
[16Star][10d] [Py] securemode/trelloc2 Simple C2 over the Trello API
[14Star][1y] [Py] j3ssie/c2s Command and Control server on Slack
[8Star][2y] [Py] maldevel/dicerosbicornis A fully featured Windows backdoor that uses email as a C&C server
[7Star][3y] [Py] killswitch-gui/flask_appengine_redirector Google App Engine Flask C2 redirector

Communication Protocol

DNS

[318Star][1m] [Py] baderj/domain_generation_algorithms Some results of my DGA reversing efforts
[220Star][17d] [Scala] sotera/spark-distributed-louvain-modularity Spark / graphX implementation of the distributed louvain modularity algorithm
[209Star][3y] [Py] endgameinc/dga_predict Predicting Domain Generation Algorithms using LSTMs
[132Star][2m] [Py] andrewaeva/dga The repository that contains the algorithms for generating domain names, dictionaries of malicious domain names. Developed to research the possibility of applying machine learning and neural networks to detect and classify malicious domains.
[117Star][6m] [Py] 360netlab/dga Suspicious DGA from PDNS and Sandbox.
[49Star][2y] [java] toufikairane/andromalware Android Malware for educational purpose
[40Star][4y] [Py] pchaigno/dga-collection A collection of known Domain Generation Algorithms
[31Star][4y] [Py] endgameinc/sans_thir16 SANS Hunting on the Cheap
[31Star][3y] [Py] staaldraad/fastfluxanalysis Scripts to detect Fast-Flux and DGA using DNS query responses
[28Star][2y] [Py] philarkwright/dga-detection DGA Domain Detection using Bigram Frequency Analysis
[13Star][3y] [Py] cisco-talos/goznym
[6Star][1y] [Py] matthoffman/degas DGA-generated domain detection using deep learning models
[4Star][3m] [PHP] navytitanium/eitest-tools-scripts-iocs
[1Star][2m] [Py] bkcs-hust/lstm-mi A LSTM based framework for handling multiclass imbalance in DGA botnet detection

[1855Star][8m] [C++] iagox86/dnscat2 create an encrypted command-and-control (C&C) channel over the DNS protocol, which is an effective tunnel out of almost every network.
[832Star][6d] [Go] bishopfox/sliver a general purpose cross-platform implant framework that supports C2 over Mutual-TLS, HTTP(S), and DNS
[386Star][4y] [Py] ahhh/reverse_dns_shell A python reverse shell that uses DNS as the c2 channel
[277Star][1y] [Py] trycatchhcf/packetwhisper Stealthily exfiltrate data and defeat attribution using DNS queries and text-based steganography. Avoid the problems associated with typical DNS exfiltration methods. Transfer data between systems without the communicating devices directly connecting to each other or to a common endpoint. No need to control a DNS Name Server.
[276Star][4m] [Go] sensepost/godoh A DNS-over-HTTPS Command & Control Proof of Concept
[225Star][2y] [PS] lukebaggett/dnscat2-powershell A Powershell client for dnscat2, an encrypted DNS command and control tool.
[176Star][2y] [C++] 0x09al/dns-persist DNS-Persist is a post-exploitation agent which uses DNS for command and control.
[41Star][2m] [Erlang] homas/ioc2rpz ioc2rpz is a place where threat intelligence meets DNS.
[38Star][2m] [JS] inquest/threatkb Knowledge base workflow management for YARA rules and C2 artifacts (IP, DNS, SSL) (ALPHA STATE AT THE MOMENT)

ICMP

WebSocket

[245Star][2y] [Py] arno0x/wsc2 A WebSocket C2 Tool
[131Star][9d] [C++] xorrior/raven CobaltStrike External C2 for Websockets

C&C

Cobalt Strike

[462Star][2y] rsmudge/malleable-c2-profiles Malleable C2 is a domain specific language to redefine indicators in Beacon’s communication. This repository is a collection of Malleable C2 profiles that you may use. These profiles work with Cobalt Strike 3.x.
[217Star][2y] [Py] bluscreenofjeff/malleable-c2-randomizer A script to randomize Cobalt Strike Malleable C2 profiles and reduce the chances of flagging signature-based detection controls
[195Star][1y] [PS] qax-a-team/cobaltstrike-toolset Aggressor Script, Kits, Malleable C2 Profiles, External C2 and so on
[188Star][2y] [C#] ryhanson/externalc2 A library for integrating communication channels with the Cobalt Strike External C2 server
[165Star][6m] threatexpress/malleable-c2 Cobalt Strike Malleable C2 Design and Reference Guide
[160Star][11d] [Py] threatexpress/cs2modrewrite Convert Cobalt Strike profiles to modrewrite scripts
[146Star][2y] [Py] und3rf10w/external_c2_framework Python api for usage with cobalt strike’s External C2 specification
[105Star][5m] xx0hcd/malleable-c2-profiles Cobalt Strike - Malleable C2 Profiles. A collection of profiles used in different projects using Cobalt Strike
[67Star][2y] [C] outflanknl/external_c2 POC for Cobalt Strike external C2
[56Star][24d] 1135/1135-cobaltstrike-toolkit about CobaltStrike
[55Star][1y] [Py] truneski/external_c2_framework Python api for usage with cobalt strike’s External C2 specification
[41Star][3y] bluscreenofjeff/malleablec2profiles Malleable C2 profiles for Cobalt Strike
[41Star][2y] [Go] empty-nest/emptynest a plugin based C2 server framework
[12Star][5m] [TS] hattmo/c2profilejs Web UI for creating C2 profiles for Cobalt Strike

Tools

[1135Star][13d] [Boo] byt3bl33d3r/silenttrinity An asynchronous, collaborative post-exploitation agent powered by Python and .NET’s DLR
[614Star][12d] [Py] trustedsec/trevorc2 a legitimate website (browsable) that tunnels client/server communications for covert command execution.
[575Star][3m] [PS] nettitude/poshc2_old Powershell C2 Server and Implants
[478Star][5m] [C++] fsecurelabs/c3 A framework for rapid prototyping of custom C2 channels, while still providing integration with existing offensive toolkits.
[442Star][3y] [CSS] graniet/chromebackdoor a PoC of pentest tool, use a MITB technique for generate a windows executable “.exe” after launch run a malicious extension or script on most popular browsers, and send all DOM datas on command and control.
[336Star][12d] [PS] nettitude/poshc2 Python Server for PoshC2
[325Star][1y] [C#] spiderlabs/dohc2 DoHC2 allows the ExternalC2 library from Ryan Hanson (
[273Star][4m] [Py] felixweyne/imaginaryc2 a python tool which aims to help in the behavioral (network) analysis of malware
[205Star][3y] [Py] countercept/doublepulsar-c2-traffic-decryptor A python2 script for processing a PCAP file to decrypt C2 traffic sent to DOUBLEPULSAR implant
[186Star][2y] [Py] woj-ciech/daily-dose-of-malware Script lets you gather malicious software and c&c servers from open source platforms like Malshare, Malcode, Google, Cymon - vxvault, cybercrime tracker and c2 for Pony.
[155Star][7d] [Py] chrispetrou/hrshell HRShell is an HTTPS/HTTP reverse shell built with flask. It is an advanced C2 server with many features & capabilities.
[136Star][2y] [Py] pjlantz/hale Botnet command & control monitor
[132Star][10m] [C] treehacks/botnet-hackpack Build a basic Command & Control botnet in C
[130Star][6d] [Py] mhaskar/octopus Open source pre-operation C2 server based on python and powershell
[125Star][7d] [JS] p3nt4/nuages A modular C2 framework
[99Star][6d] [Py] ziconius/fudgec2 FudgeC2 - a command and control framework designed for team collaboration and post-exploitation activities.
[83Star][5y] [Py] maldroid/maldrolyzer Simple framework to extract “actionable” data from Android malware (C&Cs, phone numbers etc.)
[79Star][9m] [C++] watersalesman/aura-botnet A super portable botnet framework with a Django-based C2 server. The client is written in C++, with alternate clients written in Rust, Bash, and Powershell.
[70Star][14d] [Py] angus-y/pyiris-backdoor a modular, stealthy and flexible remote-access-toolkit written completely in python used to command and control other systems.
[68Star][1m] [C#] maraudershell/marauder A .NET agent for the Faction C2 Framework
[67Star][5m] [HTML] project-prismatica/prismatica Responsive Command and Control System
[58Star][1y] [C#] mdsecactivebreach/browser-externalc2 External C2 Using IE COM Objects
[56Star][2y] [Go] averagesecurityguy/c2 A simple, extensible C&C beaconing system.
[48Star][3m] [Shell] professionallyevil/c4 Cyberdelia, a Collection of Command and Control frameworks
[44Star][30d] [JS] shadow-workers/shadow-workers C2 and proxy designed for penetration testers to help in the exploitation of XSS and malicious Service Workers (SW)
[41Star][2y] [Py] v1v1/sleight Empire HTTP(S) C2 redirector setup script
[39Star][1y] [PS] outflanknl/doh_c2_trigger Code for blogpost:
[38Star][12d] [C#] sf197/telegra_csharp_c2 Command and Control for C# Writing
[37Star][11m] [Go] prsecurity/golang_c2 Boilerplate C2 written in Go for red teams
[31Star][16d] [Py] qsecure-labs/overlord Overlord - Red Teaming Infrastructure Automation
[30Star][6y] [PS] enigma0x3/powershell-c2
[24Star][1y] prsecurity/neutrino Neutrino C2 Source Code
[23Star][25d] [Go] audibleblink/bothan Is this IP a C2 server?
[19Star][1y] tevora-threat/rt_redirectors Ansible role to configure redirectors for red team C2
[18Star][5y] [PS] et0x/c2 Methods of C2
[18Star][1m] [Py] marcorosa/cnc-botnet-in-python C&C Botnet written in Python with fabric
[17Star][1y] [C] kiwidoggie/oni-framework Embedded systems C2 software written in C/C#
[17Star][3y] [Go] pandipanda69/my-little-honeypot This repository aims to show how easy it is to code a telnet honeypot in order to recovering IOT malwares, and thus, active Command & Control.
[17Star][4m] stvemillertime/absolutely-positively-not-hacking-back-with-pcap Streaming Unexpected Network Byte Sequences with High Probability of Blue Screening or Otherwise Crashing Attacker Command-and-Control Nodes
[16Star][4y] [Py] hasherezade/bunitu_tests Scripts for communication with Bunitu Trojan C&Cs
[16Star][6m] [C] blacchat/xzf EXIF-based command and control PoC
[16Star][10m] [Py] daniel-infosec/wikipedia-c2 POC for utilizing wikipedia API for Command and Control
[14Star][5y] [Py] nocow4bob/pix-c2 Ping Exfiltration Command and Control (PiX-C2)
[14Star][3y] [Py] secarmalabs/indushell PoC C&C for the Industroyer malware
[14Star][5m] [C#] immersive-command-system/immersivedroneinterface aerial vehicle command and control platform, designed for immersive interfaces (such as the Oculus Rift).
[11Star][4m] [Py] jacobsoo/amtracker Android Malware Tracker
[10Star][12m] [Dockerfile] d3vzer0/cnc-relay Docker projects to retain beacon source IPs using C2 relaying infra
[10Star][9m] [Py] m8r0wn/transportc2 PoC Command and Control Server. Interact with clients through a private web interface, add new users for team sharing and more.
[10Star][3y] [Py] r3mrum/loki-parse A python script that can detect and parse loki-bot (malware) related network traffic. This script can be helpful to DFIR analysts and security researchers who want to know what data is being exfiltrated to the C2, bot tracking, etc…
[9Star][4m] [Py] degenerat3/meteor Cross-platform C2 with modules for TCP, web, and more soon to come
[8Star][2m] [Py] jacobsoo/malconfig This is part of a module for the framework that i’m constantly developing. Currently only information of the C2 are disclosed here.
[8Star][3y] [Py] killswitch-gui/flask_heroku_redirector flask heroku C2 redirector template
[8Star][5m] [Py] r00k5a58/pyc2 simple c2 written in python to demonstrate security concepts
[8Star][11m] tothi/kali-rpi-luks-crypt Full disk encryption for Kali on Raspberry using LUKS
[8Star][25d] [Go] xorrior/apfell-chrome-extension-c2server Apfell C2 Server for the Google Chrome Extension Payload
[7Star][3y] [PS] 0sm0s1z/invoke-selfsignedwebrequest This repo exists as a quick and dirty arsenal of methods and scripts to subvert .NET SSL/TLS certificate validation in PowerShell and press on with the hack!
[6Star][2y] [C#] jaydcarlson/c2-printf 通过 Silicon Labs C2 调试器连接打印跟踪消息
[6Star][5m] [Py] m507/m-botnet A C2 project that controls a self-propagating MS17-010 worm.
[5Star][3y] [Py] killswitch-gui/flask_pythonanywhere_redirector flask pythonanywhere C2 redirector template
[4Star][3y] [Py] mellow-hype/c2finder Look for un-sinkholed C&C IPs in your Bro logs (from Bambanek Consulting C&C master list)
[4Star][2y] [PHP] nao-sec/ramnit_traffic_parser Parsing Ramnit’s traffic
[3Star][23d] [C++] lima-x-coding/win32.-d0t-nix.c2 A C/C++ recreation off the original Win32.VB.Illerka.C Virus by Michael [APFX]
[0Star][2y] [Py] bizdak/silverboxcc Reverse engineered android malware, and this is a C&C server for it
[0Star][2y] boaxboax/ctf-quaorar

Post

RAT

Tools

[1615Star][9d] [Py] zerosum0x0/koadic Koadic C3 COM Command & Control - JScript RAT
[1473Star][3y] [Py] nathanlopez/stitch a cross platform python framework which allows you to build custom payloads for Windows, Mac OSX and Linux as well
[789Star][4m] [Py] kevthehermit/ratdecoders Python Decoders for Common Remote Access Trojans
[764Star][7d] [C] rdesktop/rdesktop rdesktop is an open source UNIX client for connecting to Windows Remote Desktop Services, capably of natively speaking Remote Desktop Protocol (RDP) in order to present the user’s Windows desktop. rdesktop is known to work with Windows server version ranging from NT 4 terminal server to Windows 2012 R2.
[706Star][1y] [PS] arvanaghi/sessiongopher a PowerShell tool that uses WMI to extract saved session information for remote access tools such as WinSCP, PuTTY, SuperPuTTY, FileZilla, and Microsoft Remote Desktop. It can be run remotely or locally.
[538Star][10d] [JS] mr-un1k0d3r/thundershell a C# RAT that communicates via HTTP requests
[392Star][5m] [C++] werkamsus/lilith Lilith, The Open Source C++ Remote Administration Tool (RAT)
[297Star][2y] [Py] 0xislamtaha/python-rootkit Python Remote Administration Tool (RAT) to gain meterpreter session
[238Star][6d] [C#] b4rtik/redpeanut RedPeanut is a small RAT developed in .Net Core 2 and its agent in .Net 3.5 / 4.0.
[222Star][9d] [C++] xdnice/pcshare PCShare是一款强大的远程控制软件，可以监视目标机器屏幕、注册表、文件系统等。
[214Star][2y] [C#] them4hd1/vayne-rat An Advanced C# .NET Rat, It’s Stable and Contains Many Features.
[205Star][2y] [C++] ahxr/ghost a light RAT that gives the server/attacker full remote access to the user’s command-line interprete
[201Star][10d] [Py] pure-l0g1c/loki Remote Access Tool/Botnet
[195Star][3m] [PHP] 0blio/caesar An HTTP based RAT (Remote Administration Tool) that allows you to remotely control devices from your browser
[175Star][4y] [C#] alphadelta/secure-desktop Anti-keylogger/anti-rat application for Windows
[172Star][3y] [C++] hussein-aitlahcen/blackhole C# RAT (Remote Administration Tool)
[157Star][10d] [Visual Basic] mwsrc/plasmarat Remote Access Trojan(RAT), Miner, DDoS
[140Star][1m] [Py] anhkgg/pyrat PyRat，a rat by python xmlrpc
[136Star][25d] [C++] earthquake/universaldvc Universal Dynamic Virtual Channel connector for Remote Desktop Services
[129Star][2y] [Py] dviros/rat-via-telegram Windows Remote Post Breach Tool via Telegram
[115Star][4y] [C#] leurak/trollrat a Remote Administration Tool (RAT) which follows a different approach than the other RATs
[98Star][4m] [JS] securityrat/securityrat OWASP SecurityRAT (version 1.x) - Tool for handling security requirements in development
[95Star][7y] [C#] ilikenwf/darkagent DarkAgent Remote Administration Tool RAT by DragonHunter
[95Star][2y] [Pascal] senjaxus/allakore_remote Open Source Remote Access software written in Delphi Seattle.
[80Star][4y] [C++] rwhitcroft/dnschan A remote access trojan over DNS
[77Star][4y] [Py] ahhh/reverse_https_bot A python based https remote access trojan for penetration testing
[66Star][11d] [Visual Basic] thesph1nx/rt-101 VB.net Remote Administrator Tool (RAT)
[65Star][7m] sh1n0g1/shinobot RAT / Botnet Simulator for pentest / education
[61Star][28d] [Visual Basic] thesph1nx/slickermaster-rev4 NSA Hacking Tool Recreation UnitedRake
[61Star][2m] [C#] nyan-x-cat/mass-rat Basic Multiplatform Remote Administration Tool - Xamarin
[58Star][3y] [PS] killswitch-gui/persistence-survivability Powershell Persistence Locator
[57Star][3y] [Py] m4sc3r4n0/spyrat Python Remote Access Trojan
[55Star][4y] [Py] ahhh/ntp_trojan Reverse NTP remote access trojan in python, for penetration testers
[53Star][8d] [Java] blackhacker511/blackrat BlackRAT - Java Based Remote Administrator Tool
[52Star][12d] [Py] technowlogy-pushpender/technowhorse TechNowHorse is a RAT (Remote Administrator Trojan) Generator for Windows/Linux systems written in Python 3.
[50Star][11d] [C#] brunull/pace A Remote Access Tool for Windows.
[46Star][1m] [Pascal] 0x48piraj/malwarex Collection of killers
[46Star][1m] [PHP] davidtavarez/pinky pinky - The PHP mini RAT (Remote Administration Tool)
[46Star][20d] [Shell] infosecn1nja/ycsm This is a quick script installation for resilient redirector using nginx reverse proxy and letsencrypt compatible with some popular Post-Ex Tools (Cobalt Strike, Empire, Metasploit, PoshC2).
[46Star][18d] [Java] m301/rdroid [Android RAT] Remotely manage your android phone using PHP Interface
[46Star][2y] pentestpartners/ptp-rat Exfiltrate data over screen interfaces
[44Star][2y] [Shell] taherio/redi Automated script for setting up CobaltStrike redirectors (nginx reverse proxy, letsencrypt)
[41Star][3y] [C] killswitch-gui/hotload-driver C++
[40Star][5y] [C++] lingerhk/0net 一个简单的Windows远程控制后门
[40Star][3y] [Visual Basic .NET] mwsrc/betterrat Better Remote Access Trojan
[39Star][1m] [Shell] samyk/easel-driver Easel driver for Linux (and Mac/Windows) + remote access to CNC controller
[37Star][11d] [PS] 5alt/zerorat ZeroRAT是一款windows上的一句话远控
[36Star][5m] [C#] blackvikingpro/aresskit Next Generation Remote Administration Tool (RAT)
[35Star][3y] ritiek/rat-via-telegram Removed according to regulations
[29Star][1m] [Py] the404hacking/windows-python-rat A New Microsoft Windows Remote Administrator Tool RAT with Python by Sir.4m1R.
[26Star][2y] [Py] thegeekht/loki.rat Loki.Rat is a fork of the Ares RAT, it integrates new modules, like recording , lockscreen , and locate options. Loki.Rat is a Python Remote Access Tool.
[25Star][9m] [D] alexa-d/alexa-openwebif alexa skill to control your openwebif device
[24Star][2y] [Py] rootm0s/casper 👻 Socket based RAT for Windows with evasion techniques and other features for control
[22Star][16d] [C#] rainkin1993/remote-access-trojan-database A database of RAT collected from Internet
[21Star][11d] [Py] kaiiyer/backnet Backdoor+Botnet or BackNet is a Python Remote Access Tool.
[19Star][7d] [Py] lithium95/controll_remote_access_trojan Created a VERY SIMPLE remote access Trojan that will establish administrative control over any windows machine it compromises.
[18Star][10m] [PHP] eddiejibson/limitrr-php Better PHP rate limiting using Redis.
[18Star][3y] [Py] landonpowell/orwell-rat-and-botnet Orwell is a RAT and Botnet designed as a trio of programs by Landon Powell.
[17Star][17d] [YARA] deadbits/yara-rules Collection of YARA signatures from individual research
[17Star][2m] [PHP] rizer0/rat-hunter detect trojans by easy way
[14Star][3y] [Java] mhelwig/adwind-decryptor Simple decrypter for Java AdWind, jRAT, jBifrost trojan
[14Star][2y] [Py] mitre/caldera-agent
[14Star][1y] shifa123/maarc A Python - Remote Administration Tool (RAT)
[12Star][2y] [JS] node-rat/noderat NodeRat is remote access tool made with NodeJS and python
[11Star][3y] [Pascal] mwsrc/schwarze-sonne-rat SS-RAT (Schwarze-Sonne-Remote-Access-Trojan)
[10Star][7m] [Go] alanbaumgartner/aurora Aurora Remote Administration Tool
[10Star][12m] [Py] user696/mrrat
[9Star][2y] [Py] cisco-talos/remcos-decoder Talos Decryptor POC for Remcos RAT version 2.0.5 and earlier
[9Star][8d] [Py] federicochieregato/darkfox Remote access trojan created using WinRar with firefox installer and python Reverse Shell embedded.
[8Star][2y] thejollysin/i-wish-i-were-at-defcon-25-hack-a-thon My own “I wish I were at DefCon 25” Hack-a-Thon
[8Star][4y] [C++] xyl2k/black-eye-rsa-attacking-toolkit-v0.1f-compiled The great RSA Attacking Toolkit compiled for Windows
[7Star][2y] [C#] advancedhacker101/android-c-sharp-rat-server This is a plugin for the c# R.A.T server providing extension to android based phone systems
[7Star][6m] [Py] e-rror/hiroo
[7Star][2y] [C#] mitre/caldera-crater
[7Star][1y] [JS] roccomuso/netrat Damn easy multiplatform Node.js RAT generator.
[7Star][2y] [Py] lukebob-zz/c2-pwn Uses Shodan API to pull down C2 servers to run known exploits on them.
[6Star][18d] [Py] apacketofsweets/apollo A simple, lightweight Remote Access Tool written in Python
[6Star][1y] [Py] z4rk/winshell Python opensource RAT/Botnet
[6Star][4y] [Visual Basic .NET] gaiththewolf/d-rat_vb.net_mysql_php D-RAT [VB.NET]+[MySQL]+[PHP]
[6Star][7d] [PHP] katsana/remote-control Grant remote access to user account without sharing credentials
[5Star][8m] [Go] alepacheco/client Windows, OS X and linux RAT client
[5Star][17d] [C++] melardev/xeytanwin32-rat WORK IN PROGRESS. RAT written in C++ using Win32 API
[4Star][16d] [C++] izanbf1803/rat-cpp-prototype A simple RAT.
[4Star][3m] [C++] melardev/xeytanwxcpp-rat Work in Progress. RAT written in C++ using wxWidgets
[3Star][2y] [Py] bedazzlinghex/memory-analysis Contains tools to perform malware and forensic analysis in Memory
[3Star][1m] [Kotlin] eskatos/creadur-rat-gradle Apache RAT (Release Audit Tool) Gradle Plugin
[3Star][1m] [Py] gbrn1/pirate Python Remote Access Tool
[2Star][4y] [Py] dakotanelson/multicat PoC RAT using the sneaky-creeper data exfiltration library
[2Star][4y] [Visual Basic .NET] retrobyte/shadowtech-rat An example of a remote administration tool.
[NoneStar][socprime/sobaken-rat-detector](https://github.com/socprime/sobaken-rat-detector)

[610Star][1y] [PS] fortynorthsecurity/wmimplant This is a PowerShell based tool that is designed to act like a RAT. Its interface is that of a shell where any command that is supported is translated into a WMI-equivalent for use on a network/remote machine. WMImplant is WMI based.
[518Star][8m] [Visual Basic .NET] nyan-x-cat/lime-rat LimeRAT | Simple, yet powerful remote administration tool for Windows (RAT)
[493Star][6m] [Py] viralmaniar/powershell-rat Python based backdoor that uses Gmail to exfiltrate data through attachment. This RAT will help during red team engagements to backdoor any Windows machines. It tracks the user activity using screen capture and sends it to an attacker as an e-mail attachment.
[360Star][8d] [C#] nyan-x-cat/asyncrat-c-sharp Open-Source Remote Administration Tool For Windows C# (RAT)
[340Star][3y] [Pascal] malwares/remote-access-trojan Windows Remote-Access-Trojan
[229Star][4y] [Py] hood3drob1n/jsrat-py This is my implementation of JSRat.ps1 in Python so you can now run the attack server from any OS instead of being limited to a Windows OS with Powershell enabled.
[149Star][4m] [Py] safebreach-labs/sireprat Remote Command Execution as SYSTEM on Windows IoT Core
[119Star][11d] [C#] dannythesloth/vanillarat VanillaRat is an advanced remote administration tool completely coded in C# for Windows.
[117Star][8d] [Py] thelinuxchoice/pyrat Windows Remote Administration Tool (RAT)
[106Star][9m] [C#] r-smith/splice-admin A remote Windows administration tool. You know you want it.
[104Star][2y] [Py] syss-research/outis a custom Remote Administration Tool (RAT) or something like that. It was build to support various transport methods (like DNS) and platforms (like Powershell).
[70Star][3m] [PS] dsccommunity/certificatedsc DSC resources to simplify administration of certificates on a Windows Server.
[67Star][4y] [C#] stphivos/rat-shell Windows Remote Access Trojan (RAT)
[39Star][2m] [Py] swordf1sh/moderat Experimental Windows Remote Administration and Spy Tool in Python + GUI
[20Star][1y] [Visual Basic] nyan-x-cat/asyncrat Remote Administration Tool For Windows
[17Star][6m] [Py] operatorequals/smbrat A Windows Remote Administration Tool in Visual Basic with UNC paths
[16Star][6m] [PS] yschgroup/skyrat SkyRAT - Powershell Remote Administration Tool

[131Star][8m] [C] abhishekkr/n00brat Remote Administration Toolkit (or Trojan) for POSiX (Linux/Unix) system working as a Web Service
[68Star][10m] [JS] webxscan/linux_rat Linux Reverse Shell RAT
[51Star][15d] [C] thibault-69/rat-hodin-v2.9 Remote Administration Tool for Linux
[20Star][2m] [C] lillypad/swamp-rat A Linux RAT in C
[7Star][5m] [C] ctsecurity/stealth-kid-rat Stealth Kid RAT (SKR) is an open source Linux remote administration tool written in C. Licensed under MIT. The SKR project is fully developed and tested on Debian GNU-Linux (Deb 9.3 “Stretch”) platform. The RAT will soon be available on Windows platform by mid 2018.

[430Star][9d] [ObjC] sap/macos-enterprise-privileges For Mac users in an Enterprise environment this app ensures secure environment and yet gives the User control over administration of their machine by elevating their level of access to Administrator privilege on macOS X. Users can set the time frame using Preferences to perform specific tasks such as install or remove an application.
[75Star][4y] [Pascal] xlinshan/coldroot Mac OS Trojan (RAT) made with love <3
[74Star][1y] [Py] kdaoudieh/bella Bella is a pure python post-exploitation data mining tool & remote administration tool for macOS.
[21Star][2m] [Py] cys3c/evilosx A pure python, post-exploitation, remote administration tool (RAT) for macOS / OS X.

[1815Star][8m] [Smali] ahmyth/ahmyth-android-rat Android Remote Administration Tool
[939Star][7y] designativedave/androrat Remote Administration Tool for Android devices
[931Star][6y] [Java] wszf/androrat Remote Administration Tool for Android
[172Star][2y] [Java] the404hacking/androrat AndroRAT | Remote Administrator Tool for Android OS Hacking
[138Star][3y] [Java] mwsrc/betterandrorat Android Remote Access Trojan
[66Star][7y] [Java] ibrahimbalic/androidrat Android RAT
[64Star][16d] [Java] globalpolicy/phonemonitor A Remote Administration Tool for Android devices
[50Star][3y] [Py] alessandroz/pupy Pupy is an opensource, multi-platform (Windows, Linux, OSX, Android), multi function RAT (Remote Administration Tool) mainly written in python.
[6Star][2y] rev-code/androidclient Android remote administration client

All Resource Collection Projects

RAT

Post

Covenant

Tools

Post

Slackor

Tools

Post

QuasarRAT

Tools

Post

EvilOSX

Tools

Post

Merlin

Tools

Post

Commercial Tools

Team Viewer

Tools

Post

RAT Malware

Gh0st

Tools

Post

NanoCore

Tools

Post

NjRat

Tools

Post

Revenge RAT

Tools

Post

PlugX

Tools

Post

RemcosRAT

L0rdixRAT

LodaRAT

GulfRAT

NetWireRAT

JhoneRAT

Dacls

BlackRemote

Orcus

NukeSped

DarkComet

WarZone RAT

BlackShades

DenesRAT

WSH RAT

Qrypter RAT

Adwind

CannibalRAT

jRAT

jsRAT

CrossRat

ArmaRat

RokRAT

CatKARAT

TheFatRat

OmniRAT

LuminosityLink

Other

Pubic Service For C&C

Telegram

Tools

Post

Twitter

Tools

Post

GMail

Tools

Post

Github

Tools

Post

DropBox