EtherealGh0st
Description
(Bitdefender) A variant of Gh0st RAT, evolved from TranslucentGh0st. The execution of the EthrealGh0st agent starts with the decryption of c2 addresses and ports, which are base64 encoded strings. After decoding, a SUB 6 operation is performed on the resulting buffer, and the c2 and port are passed down to establish the connection. Although the port is also encoded, it always has the same value, “Ojo5,” which corresponds to 443 after decryption.
Names
| Name |
|---|
| EtherealGh0st |
Category
Malware
Type
- Backdoor
Information
Other Information
Uuid
83f74a13-33e7-432a-bbfe-291c4530d39a
Last Card Change
2024-06-18