Loading malware…
Gh0st RAT is a Windows remote access trojan originating from a Chinese malware lineage whose source code leaked around 2008, leading to extensive reuse, modification, and derivative development by multiple threat actors. It has been associated with Chinese espionage activity, including use by clusters such as BRONZE EDISON, and its codebase has influenced later malware such as Milestone and early components of the Soul framework. Variants and descendants have been used in intrusion operations targeting a range of sectors, including espionage-focused campaigns.
Gh0st RAT provides full remote administration capabilities for compromised Windows hosts. Documented functions include process listing, remote shell access for command execution, screen capture, keylogging, and file deletion. It supports encrypted command-and-control communications, with reported use of RC4 and XOR as well as zlib compression prior to encryption in some variants. Execution and loading tradecraft observed with Gh0st RAT includes DLL side-loading, use of rundll32, and in-memory loading of a decrypted Gh0st RAT DLL by an initial dropper.
Persistence has been established through Windows Registry autorun mechanisms, including Registry Run keys, and variants have modified system Registry data such as installation-time values. The family is notable both as a long-lived RAT in its own right and as a foundational codebase reused by later espionage malware families that retained remote control and surveillance functionality while altering command-and-control mechanisms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
gh0st RAT is able to open a remote shell to execute commands.
A Chinese advanced persistent threat tracked as Deep Panda has been observed exploiting the Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor and a novel rootkit on infected machines with the goal of stealing sensitive data. The latest set of attacks documented by Fortinet shows that the infection procedure involved the exploitation of the Log4j remote code execution flaw (aka Log4Shell) in vulnerable VMware Horizon servers.
另一种是格式攻击文档,利用漏洞CVE-2012-0158来释放并执行可执行文件,同时打开欺骗收件人的“正常”文档文件。... CVE-2012-0158是一个文档格式溢出漏洞... 该组织则使用了MHT格式,这种格式同样可以触发漏洞,而且在当时一段时间内可以躲避多种杀毒软件的查杀。 | 通过我们对于案例4中update.exe的分析,得到该样本所使用的互斥量为“chinaheikee__inderjns”,该互斥量与我们分析过的gh0st样本的互斥量一致,是默认配置,而且上线数据包与gh0st 3.75版本非常一致,因此我们可以判定该update.exe为gh0st后门。
The first flaw affects the Firefox browser and is tracked as CVE-2019-17026... Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices. | Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices.
The second, designated CVE-2020-0674, is a remote code execution (RCE) flaw in Internet Explorer. Both bugs were patched in January and February 2020. Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices. | Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices.
We first observed this actor in July of 2018 exploiting a WebLogic vulnerability (CVE-2017-10271) to drop a miner that was associated with a campaign called "MassMiner".
These attacks began with exploitation of CVE-2022-3236 which is detailed in Sophos Security Advisory sophos-sa-20220923-sfos-rce.
As in the CVE-2022-1040 attack, the attackers built a malware that inspects all ping packets, waiting for a specially crafted ping packet that would not, otherwise, occur “in nature.”
“RAT malware such as Gh0stRAT and PlugX often used by Chinese threat actors…”
32 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Among the hosted files in the HFS server we can also find a PE executable labeled as BX.exe, which is a Gh0st RAT variant.
It is primarily targeted at North Korean-related organizations and is believed to be aimed at stealing information using AttackBot, PIZ Stealer, and Gh0st RAT.
Among the hosted files in the HFS server we can also find a PE executable labeled as BX.exe, which is a Gh0st RAT variant.
Gh0st is an open-source RAT that has been observed being used maliciously by cybercriminals and APT actors such as 'TA459' and 'APT18.'
A Gh0st remote access Trojan/tool (RAT) was delivered via PowerRatankba.B to several devices running common cryptocurrency-related applications.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
Download payload from provided URL and execute via memory injection... inject into process memory using Invoke-ReflectivePEInjection... RatankbaPOS will be written to disk as c:\windows\temp\hkp.dll and the PID of xplatform.exe process will be used to inject hkp.dll into xplatform.exe using LoadLibraryA and CreateRemoteThread
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
Download payload from provided URL and execute via memory injection... inject into process memory using Invoke-ReflectivePEInjection... RatankbaPOS will be written to disk as c:\windows\temp\hkp.dll and the PID of xplatform.exe process will be used to inject hkp.dll into xplatform.exe using LoadLibraryA and CreateRemoteThread
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
enabling the Lazarus Group to conduct lucrative operations stealing Bitcoin and other cryptocurrencies... targeting a point-of-sale related framework for the theft of credit card data
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."
Based on the leaked source code of the infamous Gh0st RAT but with notable differences in the command-and-control (C2) communication mechanism employed, Milestone is also designed to send information about the current sessions on the system to the remote server.
PowerRatankba utilizes HTTP for its C&C communication... RatankbaPOS... makes an HTTP request to a hardcoded URL... Once the stolen data has been obfuscated, it is sent in a POST HTTP request
We already saw the usage of a HTTP tunnel tool to create a network tunnel between the infected system and a C2 server... several remote access tools such as Gh0stRAT and Venom multi-hop proxy were deployed
Almost one-third of prevalent malware families we recently analyzed support communication over non-HTTP/S protocols.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
475 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan deployed after security controls are weakened via abuse of a signed vulnerable driver. It enables remote control of infected Windows systems and may be used for file theft, screen monitoring, command execution, and as a staging point for further intrusions.
A remote access trojan referenced as the family/variant lineage for ValleyRAT.
Legacy RAT cited as the code lineage ancestor for ValleyRat and indirectly SafeRat, particularly around registry-based operator note/group handling.
Gh0st RAT is mentioned only as the malware lineage from which LURK0 is derived.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.