gh0st RAT

APT19 downloaded and launched code within a SCT file; APT32 used COM scriptlets to download Cobalt Strike beacons; APT37 used Ruby scripts to execute payloads; ArcaneDoor included the adversary executing command line interface (CLI) commands.

Previous research on the group’s activity found that it uses custom loaders hidden behind decoy documents...

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

In that research, the version of Gh0st RAT included features such as ... network service creation...

The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.

The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.

Access Token Manipulation: T1134 This Gh0st RAT variant adjusts its process token to enable “SeDebugPrivilege”, allowing it to interact with and manipulate other processes.

In that research, the version of Gh0st RAT included features such as ... network service creation...

The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, .lnk files, or .bat files in the Windows Startup folder.

The logexts.dat file is obfuscated and includes several User Account Control (UAC) bypasses.

The logexts.dat file is obfuscated...

The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

Access Token Manipulation: T1134 This Gh0st RAT variant adjusts its process token to enable “SeDebugPrivilege”, allowing it to interact with and manipulate other processes.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

The decrypted DLL is then executed using the rundll32.exe Windows application, as shown in Figure 02.

Then the file unpacks and executes in memory its backdoor payload, a variant of the Trochilus RAT...

Delay Execution: T1678 Figure 08 shows a code snippet from Gh0st RAT implementing a ping-based sleep technique. The malware leverages ping.exe with the -n parameter to introduce a delay in execution.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution.

Input Capture: Keylogging: T1056.001 Lastly, this RAT monitors the mstsc.exe process, which is the client used for Remote Desktop Protocol (RDP) connections in Windows.

The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

System Network Configuration Discovery: T1016 This RAT also collects basic network information from the compromised host, including the MAC address.

Remote System Discovery: T1018 This Gh0st RAT variant can block access to specific domains, such as security-related websites, by utilizing a configuration file retrieved from its Command and Control (C2) server.

System Owner/User Discovery: T1033 Figure 05 shows a screenshot of a function within this RAT that identifies the process associated with DNS traffic on port 53.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

远程桌面 实时屏幕控制、多显示器支持、H.264 编码、自适应质量；Web 远程桌面:基于 WebSocket 实现,支持手机/平板通过浏览器访问远程桌面

Input Capture: Keylogging: T1056.001 Lastly, this RAT monitors the mstsc.exe process, which is the client used for Remote Desktop Protocol (RDP) connections in Windows.

T1113 Agent Tesla, AsyncRAT, Braodo Stealer, gh0st RAT, Lumma Stealer, njRAT, PlugX, RedLine Stealer, Remcos, XWorm

Some Backdoor.Oldrea samples use standard Base64 + bzip2... gh0st RAT has used Zlib to compress C2 communications data before encrypting it... HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

C2 Tracker is a free-to-use-community-driven IOC feed that uses Shodan and Censys searches to collect IP addresses of known malware/botnet/C2 infrastructure.

Application Layer Protocol: DNS: T1071.004 Figure 10 shows a code snippet from Gh0st RAT responsible for generating spoofed DNS responses.

Web Service: Dead Drop Resolver: T1102.001 If the malware detects that it is running inside a VMware virtual machine, it spawns a separate thread responsible for performing a dead drop resolver (DDR) routine.

MITRE ATT&CK Technique Malware Families T1105 0bj3ctivity Stealer, Agent Tesla, Amadey, AsyncRAT, Castle RAT, DarkCrystal RAT, gh0st RAT, Lokibot, njRAT, PlugX, QuasarRAT, RedLine Stealer, Remcos

C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.

According to the Remote Access Trojan definition, a RAT is a form of malware that provides the perpetrator remote access and control of the infected computer or server.

Unlike the last cluster however, this variant appears to have been used in an extensive DDNS cluster of infrastructure dating back to at least 2013... that campaign appeared to have slightly different tactics, techniques, and procedures (TTPs), including potentially target-themed domain infrastructure as well as heavily relying on dynamic DNS for C2 domains.