How to remove Heisenberg RAT from the operating system

What kind of malware is Heisenberg RAT?

Heisenberg RAT is a Remote Access Trojan (RAT) that forms the centerpiece of the Heisenberg malware platform - a modular Windows toolkit sold to other criminals. Alongside the RAT, the platform bundles an information stealer, a loader, a dropper, a cryptor, a packer, a file manager, dual hidden-desktop access, and a web-based control panel.

Once installed on a victim's machine, the RAT gives the operator remote control of the infected computer. The stealer component harvests browser data and cryptocurrency wallet contents, while the loader is capable of pulling down additional malware payloads at any time.

The platform was reported by KrakenLabs, who observed a threat actor using the handle HeisenbergSoft advertising it on the Exploit underground forum.

Heisenberg RAT overview

Heisenberg is offered as a Malware-as-a-Service (MaaS) product, meaning criminals can purchase ready-to-deploy builds rather than building their own tools. The RAT component weighs approximately 220 KB and is written in C, C++, and assembly language, with the server-side backend developed in Rust.

Unlike typical malware that relies on Windows' built-in networking libraries, the RAT uses a completely custom network stack. It communicates directly with the Windows kernel's network driver at a low level, bypassing the standard networking API entirely. This makes its traffic significantly harder to intercept or flag with conventional security tools.

Communications are encrypted using a custom TLS library (the system's built-in SSL/TLS is not used), and DNS lookups are routed over DNS over HTTPS (DoH), disguising the RAT's server queries as ordinary encrypted web traffic.

Remote control and data theft capabilities

The platform advertises two separate hidden-desktop modules (HVNC) plus standard VNC access. Hidden desktop access lets an attacker open a second, invisible Windows session on the victim's machine and use their browsers and applications while the victim sees nothing on their own screen.

This is particularly dangerous for online banking and cryptocurrency accounts, since the attacker operates from the victim's own computer using their existing logged-in sessions, which defeats many fraud checks that look for unfamiliar devices or locations.

The stealer component targets web browsers and cryptocurrency wallets, meaning saved passwords, session data, and wallet contents are all at risk. Operators can also run PowerShell and Command Prompt commands on the infected machine, and browse, upload, or download files through a built-in file manager.

Architecture and defense evasion

The RAT avoids linking against the standard C runtime (NoCRT, NoSTL), removing common code patterns that antivirus software looks for. It also implements full indirect system call execution with call stack spoofing - this makes the malware's calls into Windows appear to originate from trusted system code rather than from the malware process itself.

Additional anti-detection measures include PPID spoofing (making the process appear to be launched by a legitimate parent application), an ETW bypass using Vectored Exception Handlers (which disables the Windows event-tracing log that security products depend on), and routines that detect sandbox and debugger environments and refuse to run inside them.

For code execution, the RAT supports 10 types of process injection, 3 types of triggers, and 5 types of clamps. It is also designed to remain stable on modern CPUs with Intel's CET Shadow Stack protection enabled.

Code obfuscation and the .HEIZ framework

The toolkit includes a proprietary obfuscation module offering 16 levels of protection, plus optional virtual machine (VM) wrapping for individual functions. All values critical to the obfuscation are determined at runtime only, which prevents static analysis tools from extracting or predicting the protection keys.

Every build produced by the builder is polymorphic and uniquely generated - two operators purchasing the same toolkit receive binaries that look entirely different to antivirus scanners. The developer states that no patterns from common commercial protectors or published obfuscation research were used.

The framework introduces a proprietary module format called .HEIZ. Modules in this format are loaded directly into memory by the RAT, and existing EXE or DLL files can be converted into .HEIZ modules through the builder. This allows operators to extend the RAT's capabilities by packaging additional tools as plugins and deploying them remotely.

The Heiz injection method

The developer advertises a proprietary process injection technique called "Heiz." It avoids the memory management API calls that most injection methods depend on, including standard memory allocation, protection-setting, and thread-creation calls that security tools routinely monitor.

Instead, the method exploits legitimate SEC_IMAGE memory - a type of memory that NTDLL uses when loading Windows system libraries - to place the malware's code inside a target process. Because NTDLL performs the loading itself, the resulting memory appears legitimate to security tools that inspect running processes for unauthorized code.

Control panel, infrastructure, and pricing

Operators manage their victims through a web-based control panel that handles bot management and task automation, so commands can be queued and pushed to large numbers of infected machines without manual work. The customer-facing infrastructure is reachable over the Tor network, which hides where the servers are actually hosted.

According to KrakenLabs, access to the platform is advertised at $5,000 per month. Each customer is said to receive their own separate relay and command and control infrastructure, meaning one operator's servers being taken down does not disrupt the others.

It is worth noting that these are claims made by the seller in a criminal marketplace advertisement, so the real capabilities may differ from what is promised. The pricing does place Heisenberg well above typical commodity RATs, which usually sell for a fraction of that amount.

Conclusion

Heisenberg RAT gives operators remote access to infected machines while also supporting hidden-desktop control, data theft, and deployment of additional payloads. Its evasion techniques - indirect syscalls, a custom network stack, polymorphic builds, and a novel injection method - make it a particularly difficult threat to detect and remove.

Anyone with this malware on their system faces serious risks, including theft of banking and cryptocurrency funds through hidden desktop sessions, stolen passwords, identity theft, and further infections from follow-on payloads. It should be removed from the system immediately.

More examples of RATs are TONResolver, QuimaRAT, and Dolphin X.

How did Heisenberg RAT infiltrate my computer?

Heisenberg RAT is sold as a MaaS offering on the Exploit underground forum. The developer provides buyers with fully encrypted and obfuscated builds ready to deploy against victims, along with a built-in cryptor, packer, and dropper. The specific delivery method used in any given attack depends on the operator who purchased access to the builder.

Threats of this kind are commonly distributed through phishing emails, fake software download pages, pirated content, and malicious files shared over peer-to-peer networks. Attackers may disguise the payload as a legitimate application installer or bundle it with software cracks.

Other common channels include malvertising, fake software update prompts, and downloads from untrustworthy third-party sites. Because each build is uniquely obfuscated, the resulting file may not be recognized by antivirus software on first encounter - giving the attacker time to establish access before being detected.

How to avoid installation of malware?

Be cautious with unexpected emails, messages, or file attachments - especially those urging you to open or run something immediately. Download software only from official developer websites or reputable app stores. Avoid pirated content, key generators, and software cracks, as these are among the most common delivery vehicles for malware.

Keep your operating system and all installed software up to date, and use a trustworthy antivirus program with real-time protection. Be wary of browser notifications and pop-ups from websites you do not recognize. If you believe that your computer is already infected, we recommend running a scan with Combo Cleaner Antivirus for Windows to automatically eliminate infiltrated malware.

Instant automatic malware removal:

Manual threat removal might be a lengthy and complicated process that requires advanced IT skills. Combo Cleaner is a professional automatic malware removal tool that is recommended to get rid of malware. Download it by clicking the button below:

By downloading any software listed on this website you agree to our Privacy Policy and Terms of Use. To use full-featured product, you have to purchase a license for Combo Cleaner. 7 days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.

Quick menu:

• What is Heisenberg RAT?
• STEP 1. Manual removal of Heisenberg RAT malware.
• STEP 2. Check if your computer is clean.

How to remove malware manually?

Manual malware removal is a complicated task - usually it is best to allow antivirus or anti-malware programs to do this automatically. To remove this malware we recommend using Combo Cleaner Antivirus for Windows.

If you wish to remove malware manually, the first step is to identify the name of the malware that you are trying to remove. Here is an example of a suspicious program running on a user's computer:

If you checked the list of programs running on your computer, for example, using task manager, and identified a program that looks suspicious, you should continue with these steps:

Download a program called Autoruns. This program shows auto-start applications, Registry, and file system locations:

Restart your computer into Safe Mode:

Windows XP and Windows 7 users: Start your computer in Safe Mode. Click Start, click Shut Down, click Restart, click OK. During your computer start process, press the F8 key on your keyboard multiple times until you see the Windows Advanced Option menu, and then select Safe Mode with Networking from the list.

Video showing how to start Windows 7 in "Safe Mode with Networking":

Windows 8 users: Start Windows 8 is Safe Mode with Networking - Go to Windows 8 Start Screen, type Advanced, in the search results select Settings. Click Advanced startup options, in the opened "General PC Settings" window, select Advanced startup.

Click the "Restart now" button. Your computer will now restart into the "Advanced Startup options menu". Click the "Troubleshoot" button, and then click the "Advanced options" button. In the advanced option screen, click "Startup settings".

Click the "Restart" button. Your PC will restart into the Startup Settings screen. Press F5 to boot in Safe Mode with Networking.

Video showing how to start Windows 8 in "Safe Mode with Networking":

Windows 10 users: Click the Windows logo and select the Power icon. In the opened menu click "Restart" while holding "Shift" button on your keyboard. In the "choose an option" window click on the "Troubleshoot", next select "Advanced options".

In the advanced options menu select "Startup Settings" and click on the "Restart" button. In the following window you should click the "F5" button on your keyboard. This will restart your operating system in safe mode with networking.

Video showing how to start Windows 10 in "Safe Mode with Networking":

Extract the downloaded archive and run the Autoruns.exe file.

In the Autoruns application, click "Options" at the top and uncheck "Hide Empty Locations" and "Hide Windows Entries" options. After this procedure, click the "Refresh" icon.

Check the list provided by the Autoruns application and locate the malware file that you want to eliminate.

You should write down its full path and name. Note that some malware hides process names under legitimate Windows process names. At this stage, it is very important to avoid removing system files. After you locate the suspicious program you wish to remove, right click your mouse over its name and choose "Delete".

After removing the malware through the Autoruns application (this ensures that the malware will not run automatically on the next system startup), you should search for the malware name on your computer. Be sure to enable hidden files and folders before proceeding. If you find the filename of the malware, be sure to remove it.

Reboot your computer in normal mode. Following these steps should remove any malware from your computer. Note that manual threat removal requires advanced computer skills. If you do not have these skills, leave malware removal to antivirus and anti-malware programs.

These steps might not work with advanced malware infections. As always it is best to prevent infection than try to remove malware later. To keep your computer safe, install the latest operating system updates and use antivirus software. To be sure your computer is free of malware infections, we recommend scanning it with Combo Cleaner Antivirus for Windows.

Frequently Asked Questions (FAQ)

My computer is infected with Heisenberg RAT malware, should I format my storage device to get rid of it?

Formatting will remove the infection, but it also wipes every file on the drive. A reputable security tool such as Combo Cleaner is the safer first step and should be tried before resorting to a full format.

What are the biggest issues that Heisenberg RAT malware can cause?

Because Heisenberg RAT gives attackers remote access, the most serious risks include theft of passwords and financial data, unauthorized account access, and identity theft. Its hidden desktop feature lets criminals use online banking and cryptocurrency accounts directly from the victim's machine.

The loader component can also install additional malware - including ransomware or further stealers - meaning a single infection can escalate into multiple threats at once.

What is the purpose of Heisenberg RAT malware?

Heisenberg RAT is designed to give operators full remote control over infected computers, including hidden desktop sessions the victim cannot see. The broader platform also includes a stealer that targets browsers and cryptocurrency wallets, plus a loader for deploying further payloads.

How did Heisenberg RAT malware infiltrate my computer?

Heisenberg RAT is sold to criminal operators on the Exploit underground forum, with each buyer receiving their own infrastructure. Those operators typically distribute it through phishing emails, fake software installers, pirated content, or downloads from unofficial websites.

Will Combo Cleaner protect me from malware?

Yes. Combo Cleaner can detect and remove most known malware, including advanced threats like Heisenberg RAT. Running a full system scan is recommended to make sure no components have been left behind.