Download
What is StormTools DiscordRAT?
StormTools DiscordRAT is a simple Remote Access Trojan (RAT) written in Python 3. It serves as a proof of concept to demonstrate how malware can execute Remote Code Execution (RCE) commands on a target system while bypassing network detection systems (IDS/IPS).
How does it work?
Leveraging Discord as Command & Control (C2)
Instead of connecting directly to an unknown attacker's IP address, the malware connects to Discord’s official API servers using a Discord bot.
Evading Detection Tools
Network monitoring tools (such as Portmaster) and Intrusion Detection/Prevention Systems (IDS/IPS) only see outgoing HTTPS traffic directed toward legitimate, trusted Discord infrastructure (discord.com).
Attacker Anonymity
The operator sends commands via Discord chat messages. Security tools only log traffic to Discord rather than the attacker's actual IP address.
Note: Drops raw .py source only; no .exe build or obfuscation
Features
- Discord Bot C2 Control
- Screen Capture
- IDS/IPS Evasion
- Real-time Output
- Cross-Platform Execution
- Direct CMD Execution
- File Operations (Upload/Download)
Project Samples
