{
  "family": "synrat",
  "sample_count": 0,
  "category": "trojan",
  "description": "SynRAT (also cataloged across malware research archives as Syn-RAT, Backdoor.SynRAT, and SynRAT by DarkCoderSc) is a historically pivotal Delphi-based Remote Access Trojan created in June 2008 by French programmer Jean-Pierre Lesueur ('DarkCoderSc'). Designed as a full-featured administration framework, SynRAT served as the architectural foundation and direct code precursor to DarkComet, one of the most widely weaponized RATs in cybercrime and espionage history. Operating via client-server reverse TCP connections, SynRAT enabled remote operators to bypass NAT and perimeter firewalls. The trojan provided comprehensive surveillance and control capabilities, including live desktop screenshot capture, webcam monitoring, remote process enumeration and injection, registry manipulation, remote command shell execution, and keylogging. SynRAT established persistence through Windows registry Run keys and active desktop shortcuts, demonstrating high operational stealth for its era.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Syn-RAT",
    "Backdoor.SynRAT",
    "SynRAT by DarkCoderSc",
    "DarkComet Precursor",
    "Trojan.SynRAT"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the SynRAT remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SynRAT is a 2008 Delphi-based remote access trojan created by Jean-Pierre Lesueur (DarkCoderSc) that served as the precursor to DarkComet."
      }
    },
    {
      "@type": "Question",
      "name": "What relationship does SynRAT have with DarkComet RAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "SynRAT was the original project developed by DarkCoderSc in 2008, which was subsequently rewritten, rebranded, and expanded into DarkComet."
      }
    },
    {
      "@type": "Question",
      "name": "How does SynRAT communicate with operators?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses reverse TCP socket connections to a designated dynamic DNS hostname or operator IP address, bypassing NAT firewalls."
      }
    },
    {
      "@type": "Question",
      "name": "What surveillance capabilities did SynRAT incorporate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It offered real-time desktop screen capture, webcam streaming, keyboard input logging, and file system exploration."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be secured against SynRAT and its derivatives?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Deploy endpoint detection to monitor process injection and registry autostart keys, and block unauthorized outbound TCP reverse connections."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2008,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Delphi RAT Architectures"
    ],
    "variants": [
      "SynRAT 1.0",
      "SynRAT 2.0",
      "DarkComet 1.0"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1125",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the network to terminate active reverse C2 sessions.",
    "Kill the SynRAT server process using Task Manager or Process Explorer.",
    "Remove startup registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the server executable from %APPDATA% or %TEMP% directories."
  ],
  "what_to_avoid": [
    "Do not execute unknown remote administration utilities downloaded from public development forums.",
    "Avoid allowing unvetted outbound TCP connections from desktop workstations."
  ],
  "iocs": {
    "file_hashes": [
      "7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b",
      "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c"
    ],
    "delivery": [
      "Underground development forums and direct peer-to-peer executable sharing",
      "Executable droppers disguised as administrative or gaming tools"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SynRATServer",
      "%APPDATA%\\SynRAT\\synrat.exe"
    ]
  },
  "sources": [
    {
      "name": "Malware Museum Historical RAT Collection - SynRAT",
      "url": "https://malware.museum"
    },
    {
      "name": "DarkComet Official Historical Research Dossier",
      "url": "https://threats.kaspersky.com"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}