GodRAT
GodRAT is a previously unreported remote access trojan (RAT) based on the open-sourced Gh0st RAT/Gh0stRAT codebase. It was observed in an active campaign first detected in September 2024 and still active through at least August 12, 2025, targeting financial institutions, especially trading and brokerage firms, with activity observed in Hong Kong, the United Arab Emirates, Lebanon, Malaysia, and Jordan. Delivery involved malicious .scr and .pif files disguised as financial documents and distributed primarily via Skype; reporting also notes use of Windows screensaver files against financial institutions. The malware chain used steganography to hide shellcode in image files, with loaders extracting and injecting shellcode into memory and then retrieving second-stage payloads from command-and-control servers. One observed sample used a self-extracting .scr containing SDL2.dll loaded by Valve.exe; the loader and Valve.exe were signed with an expired DigiCert-issued certificate for Valve. A related loader established persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run\MyStartupApp pointing to Valve.exe. First-stage shellcode searched for the string "godinfo," decoded configuration data with XOR key 0x63, connected to C2, sent "GETGOD," and received second-stage shellcode containing a UPX-packed GodRAT DLL. The GodRAT DLL had internal name ONLINE.dll, exported a single function named "run," used the unusual command-line argument "-Puppet," and attempted to execute inside curl.exe or cmd.exe. Capabilities directly reported include collection of OS details, hostname, process information, username, installed antivirus information, and presence of a capture driver; injection of plugin DLLs into memory; downloading and executing files from URLs; opening URLs through Internet Explorer; and writing configuration data to %AppData%\config.ini. Outbound data was compressed with zlib, prepended with a 15-byte header, and XOR-encoded three times before transmission. Researchers observed use of the FileManager plugin (internal name FILE.dll, export "PluginMe") for host exploration and file operations including listing, reading, writing, moving, deleting, and searching files/directories, executing applications and commands, and dropping/running 7zip from %AppData%\7z.exe and %AppData%\7z.dll. Post-compromise activity also included deployment of Chrome and Microsoft Edge password stealers and AsyncRAT as a secondary implant for persistence and extended access. Researchers assessed with high confidence that GodRAT is an evolution of AwesomePuppet and likely linked to Winnti APT activity based on shared code, the unusual "-Puppet" parameter, and other protocol and implementation similarities. Reported infrastructure included GodRAT C2 IPs 103.237.92.191, 118.99.3.33, 118.107.46.174, and 154.91.183.174.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The threat actor deployed a newly identified Remote Access Trojan (RAT) named GodRAT, which is based on the Gh0st RAT codebase.
Techniques & procedures
15 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
4 techniques
Stealth
To evade detection, the attackers used steganography to embed shellcode within image files.
In addition to malicious .scr (screen saver) files, attackers also used .pif (Program Information File) files masquerading as financial documents.
Credential Access
2 techniques
Credential Access
Discovery
2 techniques
Discovery
Collection
1 technique
Collection
Command and Control
3 techniques
Command and Control
The shellcode connects to the C2 server and transmits the string “GETGOD.” The C2 server responds with data representing the next (second) stage of the shellcode.
IOCs tracked for this family
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan targeting trading/brokerage firms; delivered via malicious .SCR files disguised as financial documents (via Skype) and incorporates Gh0st RAT code/steganography (per summary).
Previously unreported RAT targeting trading/brokerage firms; distributed as malicious .SCR files via Skype; uses steganography and code derived from Gh0st RAT (per excerpt).
Remote access trojan delivered via Windows .scr (screensaver) files, providing attackers remote control capabilities over victim systems.
A newly identified Gh0st RAT-based remote access trojan used against financial trading and brokerage firms. It is delivered via disguised .scr/.pif files, loaded through shellcode (including steganography-hidden shellcode in images), connects to C2, gathers host information, supports in-memory plugin injection, downloads and launches files, opens URLs, and can persist configuration. Its FileManager plugin enables file browsing, file operations, command execution, and use of bundled 7zip to unpack dropped files.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.