Procedure examples

gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.

gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.

gh0st RAT has a keylogger.

gh0st RAT has the capability to list processes.

gh0st RAT is able to open a remote shell to execute commands.

gh0st RAT has the capability to to delete files.

gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.

gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.

gh0st RAT can download files to the victim’s machine.

gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.

gh0st RAT has altered the InstallTime subkey.

gh0st RAT can capture the victim’s screen remotely.

gh0st RAT can load DLLs into memory.

gh0st RAT has used Zlib to compress C2 communications data before encrypting it.

gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.

A gh0st RAT variant has used rundll32 for execution.

gh0st RAT can create a new service to establish persistence.

gh0st RAT has added a Registry Run key to establish persistence.

gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.

gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.

gh0st RAT has encrypted TCP communications to evade detection.

gh0st RAT uses RC4 and XOR to encrypt C2 traffic.

A gh0st RAT variant has used DLL side-loading.

gh0st RAT is able to wipe event logs.