Tool Source Code Telegram Rat Source Code 2

1. Spying and Surveillance (Spyware)


Screenshots and Photos: /Screen (desktop capture) and /Webcam (webcam photo).
Audio Recording: /Audio <seconds> (record microphone and send to Telegram).
Location Tracking: /Location (track via IP and Wi-Fi BSSID).
System Information: /Info (OS, CPU, RAM, AV, user details).


2. Data Theft (Stealer)


Network and Apps: /WiFi (Wi-Fi passwords), /FileZilla (FTP credentials), /Discord (Discord token), /Telegram (Telegram session).
Browsers (Chrome/Opera): /Passwords (saved passwords), /Cookies (cookies), /CreditCards (credit cards), /Bookmarks (bookmarks), /History (browsing history).


3. File and Process Management


Files: /ls (list files), /CD <path> (change directory), /Download <file> (download to Telegram), /Upload <URL> (upload from link), /Remove <file> (delete file/folder), /RemoveAll (delete all files).
Processes: /Tasklist (list processes), /Taskkill <process> (kill process), "Kill all Processes" option (from menu).


4. System Control and Disruption


Power Management: /Power (menu: shutdown, restart, hibernate, logoff, BSoD – Blue Screen of Death).
Input and Display: /Freeze <seconds> (lock keyboard/mouse), /Monitor On/Off (turn monitor on/off), /Rotate <degrees> (rotate display: 0/90/180/270), /Volume <level> (volume control).
Hardware: /DVD Open/Close (CD drive control).


5. Fun and Deception Features


Messages and Audio: /Message <text> (display message box), /Speak <text> (text-to-speech).
Web and Wallpaper: /OpenURL <link> (open link in browser), send photo for /Wallpapers (set as wallpaper).
Keys: /SendKeys <text> (auto-type text), /Clipboard <text> (edit clipboard).


6. Destructive Features (Bombs)


Storage/Memory: /ZipBomb (infinite ZIP file to fill disk).
Processes: /ForkBomb (infinite CMD creation to crash CPU).


7. Command Execution and Persistence


Shell and Scripts: /CMD <command> (run CMD), /BAT <code> (batch file).
Persistence: /Autorun (menu: add to startup or uninstall). With current settings, autorun is off, but if enabled, it hides as "OneDrive Update" in Task Scheduler.
Stealth: Disable Task Manager/Regedit (currently off), BSoD protection (off).

8 .Credit Card Theft Details:

Command: /CreditCards
How it works: Extracts saved passwords and credit card info from Chrome and Opera browsers (and likely Chromium-based). Creates a CreditCards.txt file in the temp folder (like C:\Windows\Temp\TelegramRAT\) and sends it as a document to the Telegram bot.

​

​

---