Haha, you are truly a fucking idiot. Your RAT was so easy to find I can find it by pressing my face against the keyboard.
To the analysis.
Your binding attempt is shit.
SFX resource (Actual tool)
RAT (second resource)
Lol Visual Basic.
%AppData%, you say?
Malware/RAT config in %AppData%
YOU DIDN'T EVEN FUCKING CHANGE THE DEFAULT BUILD NAME YOU INEPT LITTLE SHIT. And we know you asked for help about NanoCore's client, so don't deny it isn't you.
C&C Server.
INITIAL RAT TCP CONNECTION:
C&C - 185.125.168.245 port 5552
You suck, you suck, you suck. You suck, you suck.
Not only did you try to backdoor 0day.red users, but you had the fucking audacity to ask questions about how to abuse them ON OUR OWN FUCKING FORUM.
Who the hell do you think you are, no name script kiddie asshole? You try to rat us and you don't even know how to use your own tools. Amazing! Not that I expected more from you fucking keyboard orangutans.
You have no sympathy from me. Go fuck yourself, and eat only the most potent of shit, you lowlife piece of fucking crap.
-----
Have fun bb :* I'll get the other ones too sometime.
-----