Loading malware…
Gh0st RAT is a Chinese-origin Windows remote-access Trojan whose source code was leaked around 2008, leading to a distinct lineage of derivatives and variants. It provides remote operators with interactive shell access, process enumeration, screen capture, and keystroke logging. Gh0st RAT uses encrypted command-and-control communications, including RC4 and XOR, and has used Zlib compression before encryption. Observed variants have used DLL side-loading, in-memory loading of a decrypted DLL payload, and Registry Run-key persistence. Gh0st RAT has been associated with Chinese-speaking threat activity, including use by BRONZE EDISON and distribution by Silver Fox through counterfeit vendor software-download pages targeting Chinese-speaking users.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
gh0st RAT is able to open a remote shell to execute commands.
A Chinese advanced persistent threat tracked as Deep Panda has been observed exploiting the Log4Shell vulnerability in VMware Horizon servers to deploy a backdoor and a novel rootkit on infected machines with the goal of stealing sensitive data. The latest set of attacks documented by Fortinet shows that the infection procedure involved the exploitation of the Log4j remote code execution flaw (aka Log4Shell) in vulnerable VMware Horizon servers.
另一种是格式攻击文档,利用漏洞CVE-2012-0158来释放并执行可执行文件,同时打开欺骗收件人的“正常”文档文件。... CVE-2012-0158是一个文档格式溢出漏洞... 该组织则使用了MHT格式,这种格式同样可以触发漏洞,而且在当时一段时间内可以躲避多种杀毒软件的查杀。 | 通过我们对于案例4中update.exe的分析,得到该样本所使用的互斥量为“chinaheikee__inderjns”,该互斥量与我们分析过的gh0st样本的互斥量一致,是默认配置,而且上线数据包与gh0st 3.75版本非常一致,因此我们可以判定该update.exe为gh0st后门。
The first flaw affects the Firefox browser and is tracked as CVE-2019-17026... Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices. | Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices.
The second, designated CVE-2020-0674, is a remote code execution (RCE) flaw in Internet Explorer. Both bugs were patched in January and February 2020. Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices. | Both vulnerabilities were used as part of a campaign aimed at Chinese government agencies and attributed to the DarkHotel APT. This campaign delivered the Gh0st RAT malware onto compromised devices.
We first observed this actor in July of 2018 exploiting a WebLogic vulnerability (CVE-2017-10271) to drop a miner that was associated with a campaign called "MassMiner".
These attacks began with exploitation of CVE-2022-3236 which is detailed in Sophos Security Advisory sophos-sa-20220923-sfos-rce.
As in the CVE-2022-1040 attack, the attackers built a malware that inspects all ping packets, waiting for a specially crafted ping packet that would not, otherwise, occur “in nature.”
“RAT malware such as Gh0stRAT and PlugX often used by Chinese threat actors…”
33 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Silver Fox is described as having a track record of distributing Gh0st RAT through spoofed vendor download pages; CuboidalCanine reportedly moved away from Gh0st RAT at some point.
Silver Fox is described as having a track record of distributing Gh0st RAT through spoofed vendor download pages; CuboidalCanine reportedly moved away from Gh0st RAT at some point.
Among the hosted files in the HFS server we can also find a PE executable labeled as BX.exe, which is a Gh0st RAT variant.
It is primarily targeted at North Korean-related organizations and is believed to be aimed at stealing information using AttackBot, PIZ Stealer, and Gh0st RAT.
Among the hosted files in the HFS server we can also find a PE executable labeled as BX.exe, which is a Gh0st RAT variant.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
The campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers.
ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
Download payload from provided URL and execute via memory injection... inject into process memory using Invoke-ReflectivePEInjection... RatankbaPOS will be written to disk as c:\windows\temp\hkp.dll and the PID of xplatform.exe process will be used to inject hkp.dll into xplatform.exe using LoadLibraryA and CreateRemoteThread
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The archive downloaded from the site maintains the same file name while its hash changes on every download... a wrapper installer... launches the first stage payload.
Download payload from provided URL and execute via memory injection... inject into process memory using Invoke-ReflectivePEInjection... RatankbaPOS will be written to disk as c:\windows\temp\hkp.dll and the PID of xplatform.exe process will be used to inject hkp.dll into xplatform.exe using LoadLibraryA and CreateRemoteThread
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
enabling the Lazarus Group to conduct lucrative operations stealing Bitcoin and other cryptocurrencies... targeting a point-of-sale related framework for the theft of credit card data
The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.
The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."
Based on the leaked source code of the infamous Gh0st RAT but with notable differences in the command-and-control (C2) communication mechanism employed, Milestone is also designed to send information about the current sessions on the system to the remote server.
PowerRatankba utilizes HTTP for its C&C communication... RatankbaPOS... makes an HTTP request to a hardcoded URL... Once the stolen data has been obfuscated, it is sent in a POST HTTP request
Almost one-third of prevalent malware families we recently analyzed support communication over non-HTTP/S protocols.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
502 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote-access trojan mentioned as a historically distributed malware family used by groups connected to the activity.
Gh0stRAT is listed in the reference's tags and Malware Families list.
A remote access trojan mentioned as malware bundled with VPN-themed lures in related campaigns targeting Chinese-speaking users.
Referenced as a malware family related to Noodle RAT, which is described as a variant of Gh0st RAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.