Gh0st RAT
Description
(Infosec Institute) Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth.
Below is a list of Gh0st RAT capabilities. Gh0st RAT can:
• Take full control of the remote screen on the infected bot. • Provide real time as well as offline keystroke logging. • Provide live feed of webcam, microphone of infected host. • Download remote binaries on the infected remote host. • Take control of remote shutdown and reboot of host. • Disable infected computer remote pointer and keyboard input. • Enter into shell of remote infected host with full control. • Provide a list of all the active processes. • Clear all existing SSDT of all existing hooks.
Names
| Name |
|---|
| Gh0st RAT |
| Ghost RAT |
| AngryRebel |
| Farfli |
| PCRat |
| Moudour |
| Mydoor |
Category
Tools
Type
- Reconnaissance
- Backdoor
- Keylogger
- Info stealer
Information
- https://resources.infosecinstitute.com/gh0st-rat-complete-malware-analysis-part-1/
- https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/
- http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf
- https://www.proofpoint.com/us/threat-insight/post/north-korea-bitten-bitcoin-bug-financially-motivated-campaigns-reveal-new
- https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf
- http://www.malware-traffic-analysis.net/2018/01/04/index.html
- https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/decoding-network-data-from-a-gh0st-rat-variant/
- http://www.hexblog.com/?p=1248
- https://blog.cylance.com/the-ghost-dragon
- https://www.intezer.com/blog-chinaz-relations/
- https://cofense.com/blog/open-source-gh0st-rat-still-haunting-inboxes-15-years-after-release/
Mitre Attack
Malpedia
Alienvault Otx
- https://otx.alienvault.com/browse/pulses?q=tag:Gh0st%20RAT
- https://otx.alienvault.com/browse/pulses?q=tag:PCRat
Other Information
Uuid
c4684682-855e-4968-abaa-f930a6e4efcb
Last Card Change
2023-04-26