BitRAT is a remote access trojan that's been flooding underground criminal markets since its introduction at an almost laughably low price point of $20 for lifetime access. That bargain-basement cost has made it one of the most popular malware-as-a-service tools available to cybercriminals, meaning thousands of different attackers are using it in wildly different ways. If your Windows computer has been infected with BitRAT, you're dealing with malware that can steal passwords, activate your webcam, log keystrokes, bypass Windows security prompts, and give a remote criminal complete control over your machine.
Threat Profile
| Threat Name | BitRAT |
|---|---|
| Threat Type | Remote Access Trojan (RAT) |
| Platform | Windows (all versions) |
| File Type | Windows PE executable (.exe) |
| Typical Distribution | Trojanized software, phishing emails, watering hole attacks |
| First Observed | 2020 (Malpedia last updated 2026-07-28) |
| Market Price | $20 USD lifetime access (criminal markets) |
| Primary Capabilities | Remote control, data exfiltration, UAC bypass, keylogging, webcam access |
| Detection Aliases | BitRAT, HEUR:Trojan.Win32.Generic, Trojan.GenericKD |
| Prevalence | High—widely available on underground forums |
| Removal Difficulty | Moderate to High (employs persistence mechanisms and UAC bypass) |
| Data at Risk | Passwords, financial information, personal files, webcam footage, keystrokes |
How It Spreads
BitRAT's low cost and feature-rich design mean it's distributed by hundreds of different criminal operators using different tactics. You won't see a single consistent infection method—what works for one attacker might be completely different from another's approach. That said, security researchers have documented several dominant distribution patterns that account for the majority of infections we see in our Roswell repair shop.
The most common vector is trojanized software downloads. Attackers bundle BitRAT inside cracked software, pirated games, key generators, and "free" versions of paid applications. The software itself may actually work as advertised, which is what makes this approach so effective—users get the program they wanted and never realize they've also installed malware. We've seen infections delivered through fake Adobe installers, counterfeit Microsoft Office packages, and bogus system optimization utilities downloaded from sketchy websites or torrent sites.
Common distribution methods include:
- Pirated software bundles — cracked games, Adobe products, Windows activators, and office suites with the RAT embedded
- Phishing email attachments — malicious Word documents with macros, fake invoice PDFs (actually executables), shipping notifications
- Malvertising campaigns — compromised ads on legitimate websites redirecting to exploit kits or fake download pages
- Watering hole attacks — compromised websites in specific industries serving malware to targeted visitor groups
- Social engineering on Discord/Telegram — attackers posing as tech support, game modders, or software vendors sharing "helpful" tools
- SEO poisoning — malicious sites ranking high for popular software searches like "free Photoshop download" or "Windows activator"
- USB drive infections — less common but still observed, especially in business environments
What It Does On Your Machine
Once BitRAT executes, it establishes persistence on your system and opens a backdoor connection to the attacker's command-and-control server. The trojan includes a User Account Control (UAC) bypass module, meaning it can elevate its privileges without triggering those "Do you want to allow this app to make changes?" prompts that normally protect your system. This silent escalation gives the attacker administrator-level access to everything on your computer.
From that point forward, the attacker has a comprehensive toolkit at their disposal. BitRAT includes a keylogger that captures everything you type—passwords, credit card numbers, emails, private messages—and sends it back to the criminal's server. The webcam and microphone modules can be activated remotely without your knowledge, potentially capturing video and audio from your home or office. The file manager module lets attackers browse your entire hard drive, upload files to your computer, download your personal documents, or delete evidence of their intrusion.
BitRAT also functions as a cryptocurrency miner loader and can deploy ransomware as a secondary payload. Some variants we've analyzed include XMRig miner components that throttle your CPU to mine Monero, while others download and execute separate ransomware packages after the initial data exfiltration phase. The trojan can disable Windows Defender, block access to Task Manager, and terminate antivirus processes, making it extremely difficult for infected users to detect or remove the threat without professional assistance.
Manual Removal — Step by Step
Disconnect from the internet immediately
Unplug your ethernet cable or disable Wi-Fi through the physical switch on your laptop. This breaks the connection between BitRAT and the attacker's command server, preventing further data exfiltration or additional payload downloads during the removal process.
Boot into Safe Mode with Networking
Restart your computer and repeatedly press F8 (or Shift+F8 on newer systems) during boot. Select "Safe Mode with Networking" from the menu. This prevents most malware from loading while still allowing you to download removal tools. On Windows 10/11, you can also access this through Settings → Update & Security → Recovery → Advanced Startup.
Download and run Malwarebytes
From another clean computer, download Malwarebytes to a USB drive, then transfer it to the infected machine. Install and run a full system scan. Malwarebytes has good detection rates for BitRAT variants. Quarantine everything it finds, but don't restart yet—we need to address persistence mechanisms first.
Check startup programs and scheduled tasks
Press Win+R, type msconfig, and examine the Startup tab for unfamiliar entries (especially anything in AppData\Roaming). Then open Task Scheduler (taskschd.msc) and look for suspicious scheduled tasks created recently. Delete any tasks you don't recognize, particularly those pointing to temporary folders or obfuscated executables.
Manually inspect common persistence locations
Navigate to C:\Users\[YourUsername]\AppData\Roaming and look for executables with generic names like svchost.exe, update.exe, or installer.exe. BitRAT often hides in this folder. Also check C:\Users\[YourUsername]\AppData\Local\Temp. Delete any suspicious executables, but document their names and locations first in case you need this information later.
Clean the Windows Registry
Press Win+R, type regedit, and navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries pointing to AppData\Roaming executables or other suspicious paths. Delete these entries. Also check HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon for modified Shell values (should be "explorer.exe").
Re-enable Windows Defender
BitRAT typically disables Windows Defender through registry modifications or group policy changes. Open Windows Security settings and verify that Real-time Protection is enabled. If it's grayed out, you may need to re-enable it through Group Policy Editor (gpedit.msc) or by resetting the Windows Defender registry keys.
Run a second-opinion scanner
Download and run HitmanPro or Kaspersky Virus Removal Tool as a secondary verification. Different antivirus engines detect different variants, and BitRAT's customizability means a single scanner might miss operator-specific modifications. Run full scans with both tools and remove anything they flag.
Change all passwords from a clean device
Do not change passwords from the infected computer, even after cleaning. Use a phone, tablet, or another computer to change passwords for email, banking, social media, and any other accounts accessed from the infected machine. Enable two-factor authentication everywhere possible. Assume everything typed on the infected computer was captured by the keylogger.
Monitor for re-infection
Restart in normal mode and monitor system behavior for 48-72 hours. Watch for unexpected network activity, disabled antivirus, or mysterious processes. If symptoms return, the infection likely established a persistence mechanism you missed, and a complete Windows reinstall may be necessary.
Prevention
- Never download cracked software or key generators. This is the number-one infection vector we see for BitRAT. If software costs money, it costs money—pirated copies are frequently bundled with malware, and no "free Photoshop" is worth having your bank account drained.
- Verify download sources carefully. Only download software from official vendor websites or trusted repositories like GitHub (for open-source projects). Search results and ads can lead to convincing fake sites. When in doubt, type the URL manually rather than clicking search results.
- Keep Windows and all software updated. Enable automatic updates for Windows, browsers, and common applications. Many BitRAT infections exploit known vulnerabilities in outdated software that were patched months or years ago.
- Use a reputable antivirus with real-time protection. Windows Defender is acceptable if kept updated, but third-party solutions like Bitdefender, Kaspersky, or ESET offer additional protection layers. Make sure real-time scanning is enabled and actually functioning—check occasionally.
- Enable User Account Control (UAC) at high sensitivity. While BitRAT can bypass UAC, that bypass often triggers behavioral detection in modern antivirus. Don't disable UAC prompts because they're annoying—they're a critical security boundary.
- Be extremely suspicious of email attachments and links. Don't open attachments from unknown senders, and verify unexpected attachments from known senders before opening (attackers often compromise email accounts to spread malware to contacts). Hover over links to see actual URLs before clicking.
- Disable macros in Microsoft Office by default. Many BitRAT infections begin with malicious Word or Excel documents that prompt users to "enable content" or "enable macros." Legitimate documents almost never require macros. If you receive an Office document requesting macros, delete it.
- Use a standard user account for daily activities. Create a separate administrator account and use a limited standard account for web browsing, email, and routine tasks. This won't stop BitRAT entirely, but it limits the damage and makes privilege escalation more difficult.
Bring It In
BitRAT is one of the more challenging infections to remove completely because every criminal operator configures it differently. The manual removal steps above work for straightforward infections, but many variants include rootkit components, secondary payloads, or encrypted communications that require specialized tools and expertise to address properly. If you've attempted removal and symptoms persist—or if you're not comfortable performing registry edits and system-level modifications—bring your computer to our Roswell shop.
We're located on Alpharetta Street in downtown Roswell, and we handle BitRAT and similar RAT infections regularly. Our diagnostic process includes memory analysis, network traffic inspection, and forensic examination of persistence mechanisms that automated scanners often miss. Call (770) 954-1957 or stop by during business hours—we can typically accommodate same-day appointments for active infections, and we'll explain exactly what we find in plain language before proceeding with any work. Don't keep using a compromised computer and hope for the best. The longer BitRAT remains active, the more data it exfiltrates and the greater your risk of identity theft or financial fraud.