Loading malware…
Gh0st RAT is a long-running Windows remote access trojan whose source code became publicly available in 2008, leading to extensive reuse, modification, and actor-specific forks across criminal and espionage operations. It is widely recognized as a foundational RAT family and as a codebase from which numerous derivatives have been built. The malware is associated with sustained activity by multiple China-linked clusters and cybercrime ecosystems, including operations overlapping with Silver Fox, GoldenEyeDog, and related ValleyRAT-linked activity, although not every observed campaign using Gh0st RAT infrastructure or derivatives is conclusively attributable.
Gh0st RAT provides full remote administration capabilities on compromised systems. Documented functionality includes remote shell access, file upload and download, process execution and control, desktop interaction, system information gathering, screen capture, clipboard access, and data exfiltration. Observed variants and derivatives also support keylogging, credential theft, proxying, plugin-based extension, and delivery of additional payloads. Some samples check installation state through Windows service or registry artifacts, alter installation timestamps, and establish persistence through autorun entries, services, watchdog scripts, or scheduled-task mechanisms. Certain derivatives use reflective loading, process injection into system processes, AMSI bypass in adjacent payload chains, and DLL sideloading to evade detection and reduce on-disk exposure.
Operationally, Gh0st RAT has appeared in diverse intrusion chains. Delivery methods documented for Gh0st RAT or its derivatives include phishing lures, fake software installers, SEO poisoning, counterfeit download sites, malicious archives, and DLL sideloading via legitimate signed executables. Campaigns have impersonated tax authorities, software vendors, and translation software providers to induce execution. In some ecosystems, Gh0st RAT is deployed as a final-stage implant after multi-stage loaders decrypt embedded payloads or retrieve encrypted components from remote infrastructure.
The malware has been used against a broad range of victims, including finance organizations in the Asia-Pacific region, technology and education entities, state-owned enterprises, and general users in countries such as India and across Asia. Some campaigns have targeted Chinese-speaking users specifically, while others used multilingual social engineering. Because the codebase is public and heavily modified, the name Gh0st RAT may refer either to the original family or to a broad set of derivatives that retain core remote-access behavior while differing in protocol, packaging, and auxiliary modules.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
These attacks began with exploitation of CVE-2022-3236 which is detailed in Sophos Security Advisory sophos-sa-20220923-sfos-rce.
As in the CVE-2022-1040 attack, the attackers built a malware that inspects all ping packets, waiting for a specially crafted ping packet that would not, otherwise, occur “in nature.”
“RAT malware such as Gh0stRAT and PlugX often used by Chinese threat actors…”
21 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These distributors operate across Asia, employing fake software installers and leveraging variants of Gh0st RAT and WinOS (ValleyRAT) trojans.
DCRAT → VenomRAT, EchoRAT, Gh0stRAT, BitRAT, CyberSpike, Dumpling RAT, DarkRAT (via ShaShenRAT)
While the source code for Gh0st RAT was released online in 2008, the malware has continued to be used by advanced persistent threat (APT) groups. Gh0st RAT first made headlines back in 2009, when a cyber-espionage group called GhostNet used it to target diplomatic, political, economic, and military targets around the world.
While the source code for Gh0st RAT was released online in 2008, the malware has continued to be used by advanced persistent threat (APT) groups. Gh0st RAT first made headlines back in 2009, when a cyber-espionage group called GhostNet used it to target diplomatic, political, economic, and military targets around the world.
While the source code for Gh0st RAT was released online in 2008, the malware has continued to be used by advanced persistent threat (APT) groups. Gh0st RAT first made headlines back in 2009, when a cyber-espionage group called GhostNet used it to target diplomatic, political, economic, and military targets around the world.
"As part of the second stage, the group deploys customized Gh0st RAT and Poison Ivy malware payloads designed to evade detection on its victims' systems."
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection begins on fraudulent websites that copy the look of the Indian Income Tax Department, each using an “/incometax” path and a fabricated compliance notice.
MITRE ATT&CK Tactic Technique Technique ID Description / Relevance Persistence Scheduled Task/Job: Scheduled Task T1053.005 Potential use for persistence (variant-dependent).
MITRE ATT&CK Tactic Technique Technique ID Description / Relevance Execution Command and Scripting Interpreter: Windows Command Shell T1059.003 Batch files are used to monitor and reinitiate RAT processes.
The reflectively loaded DLL begins by resolving its API dependencies at runtime... CreateProcessA, VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
The attack chain employs social engineering and counterfeit domains to trick users into downloading malicious ZIP archives.
MITRE ATT&CK Tactic Technique Technique ID Description / Relevance Persistence Scheduled Task/Job: Scheduled Task T1053.005 Potential use for persistence (variant-dependent).
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
MITRE ATT&CK Tactic Technique Technique ID Description / Relevance Persistence Scheduled Task/Job: Scheduled Task T1053.005 Potential use for persistence (variant-dependent).
The chain finishes by injecting two payloads into svchost.exe processes across every active user session
then installs a persistence service disguised as “Windows Mixed Reality Service”.
The malware then fetches a file from its infrastructure that looks like an ordinary JPEG image but actually hides multiple encrypted payloads appended after the picture data.
The downloaded file is a polyglot... The malware, however, disregards the picture entirely and reads only the data appended after the image, where the real payload is stored.
RONINGLOADER to distribute a Gh0st RAT variant through NSIS installers masquerading as legitimate programs like Google Chrome and Microsoft Teams.
With elevation confirmed, the downloader prepares its staging directory under C:\Program Files\Windows Media Player, a legitimate-looking path... copies its own running binary into the working directory under the name Mixed Reality.exe.
The chain finishes by injecting two payloads into svchost.exe processes across every active user session
With elevation confirmed, the downloader prepares its staging directory under C:\Program Files\Windows Media Player, a legitimate-looking path, and removes any artifacts left by a previous run.
MITRE ATT&CK Tactic Technique Technique ID Description / Relevance Defense Evasion Deobfuscate/Decode Files or Information T1140 Malware may decode itself during runtime.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
Each implant connects to its own command server, giving the attacker a built-in backup if one connection gets blocked or detected.
203 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
168 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An older remote access trojan whose source code was published in 2008; the article describes Golden Gh0st RAT as a modified version of it.
A remote access trojan family referenced as one of the malware variants leveraged by distributors associated with Silver Fox operations.
A Gh0st RAT derivative used as one of the final in-memory implants in the campaign; it provides remote access and screen capture capability and communicates with its own C2 over port 6666.
A remote access trojan derivative used as one of the final in-memory implants in the six-stage infection chain; it provides attacker control and screen capture capability and communicates with its own C2 over port 6666.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.