I was just wondering which programming language would be the proper one to use for a RAT.
One would obviously want the program to be hard to reverse engineer but also to be deployed on different systems (cross-platform). Network traffic should be hidden as good as possible too.
My (some what) educated guess here is that Java would make sense for a cross-platform tool but is pretty easy to reverse engineer. C/C++ could be hard to reverse engineer but hard to write cross-platform. C# could be a good option but I donāt know enough about this language.
Are there any other languages that would make sense or what do you guys think?
It depends on the purpose of this RAT and the techniques you intend to use. Using low level languages like C or C++ is not going to automatically make reverse engineering your binary harder. The key here is to understand what scenarios itās designed to evade (Getting caught by AV, Network analysis, Manual reverse engineering), thinking about what techniques you want to use and then looking at your options.
If you want to do low-level stuff like import and section encryption, in-memory image loading, API hooks, code injection etc then yeah, C / C++ with some Assembly modules is probably the easiest way to go because they communicate directly with the native OS interfaces. Any of that stuff is obviously going to be OS-specific but you can encapsulate these parts.
C# and Powershell are not very far away from these interfaces, the CLR is very flexible and you can call any Windows API youād like and load native code. There are PE and shellcode loaders for them, it just requires dealing with another layer of abstraction, casting data types, pointers and such. Detecting and dealing with different .Net versions is also quite a hassle. As for Powershell, it suffers from the same problems but at least your code runs under a recognized process.
Iād also consider Rust and Go, since they are both low-level (Rust is equivalent to C, Go has a GC and does some things in the background but still basically compiles to native code), modern, have good libraries / docs and nice wrappers for network and IO.
Java and any .NET related language is definitely not the choice here. But it has already been said, itās not so much about the language. I read a topic on here the other day that was exactly like this thread, I suggest doing a little bit of searching on this forum. Also, I suggest you look into something about RSA or PGP since the unlocking whatever is on the end of the RAT is what people want.
Recently there was a counterfeiter involved in a shootout, he died, but the Secret Service is still trying to unlock his computers because of the encryption on them. The same principles could apply to any malware. The encryption is the key. (no pun intended)
I might be wrong but it looks like there are two issues with your question:
You donāt know what you want except that you want to infect as many people as possible, for whatever (malicious?) reason,
You donāt know how you want it because you donāt understand the underlying technology.
Iām going to assume you havenāt properly thought out your scope and your threat model, though you may just be hiding it from us to, say, conceal intent. Repeating what @EternalEclipse has already stated, there are multiple solutions to one problem, thatās what engineering is, coming up with multiple solutions for a single problem. Whatās also engineering is the process of designing the solution to tackle the issue sufficiently and effectively. Each problem has its own unique set of circumstances and rules and so everything ādependsā on the situation - there is usually no universal and generic answer. It seems that youāve addressed none of these before asking for assistance, so I ask you, what exactly do you want us to say? We donāt even know what youāre looking for. Do you know what youāre looking for?
From what I know, Goās OS API libraries arenāt quite mature or developed and so unless you want to spend time to define things yourself, I canāt see it as being a decent language to go towards for malware development except maybe for the sole purpose of creating a unique sample. If anything, Iād say Rust is the more appropriate language(?)
Late last year when I was looking to learn Go, I browsed around to find some libraries for WinAPI and didnāt really find many that were, or seemed, complete. I might be wrong. ĀÆ\_(ć)_/ĀÆ
The w32 bindings are quite reliable actually. It should be noted that as of now Go DLLs are officially supported and easy to generate, and other APIs received a decent makeover and things keep improving.
I agree Go has some downsides, especially when it comes to things like messing with the loader things get pretty involved. Rust is superior in that aspect.