ThaiCERT    ETDA    MDES
Report
Search
Home > List all groups > List all tools > List all groups using tool Gh0st RAT

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: Gh0st RAT

NamesGh0st RAT
Ghost RAT
AngryRebel
Farfli
PCRat
Moudour
Mydoor
CategoryTools
TypeReconnaissance, Backdoor, Keylogger, Info stealer
Description(Infosec Institute) Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth.

Below is a list of Gh0st RAT capabilities. Gh0st RAT can:

• Take full control of the remote screen on the infected bot.
• Provide real time as well as offline keystroke logging.
• Provide live feed of webcam, microphone of infected host.
• Download remote binaries on the infected remote host.
• Take control of remote shutdown and reboot of host.
• Disable infected computer remote pointer and keyboard input.
• Enter into shell of remote infected host with full control.
• Provide a list of all the active processes.
• Clear all existing SSDT of all existing hooks.
Information<https://resources.infosecinstitute.com/gh0st-rat-complete-malware-analysis-part-1/>
<https://labs.bitdefender.com/2018/02/operation-pzchao-a-possible-return-of-the-iron-tiger-apt/>
<http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf>
<https://www.proofpoint.com/us/threat-insight/post/north-korea-bitten-bitcoin-bug-financially-motivated-campaigns-reveal-new>
<https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf>
<http://www.malware-traffic-analysis.net/2018/01/04/index.html>
<https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/april/decoding-network-data-from-a-gh0st-rat-variant/>
<http://www.hexblog.com/?p=1248>
<https://blog.cylance.com/the-ghost-dragon>
<https://www.intezer.com/blog-chinaz-relations/>
MITRE ATT&CK<https://attack.mitre.org/software/S0032/>
Malpedia<https://malpedia.caad.fkie.fraunhofer.de/details/win.ghost_rat>
AlienVault OTX<https://otx.alienvault.com/browse/pulses?q=tag:Gh0st%20RAT>
<https://otx.alienvault.com/browse/pulses?q=tag:PCRat>

Last change to this tool card: 26 May 2020

Download this tool card in JSON format

Previous: Gh0stnet
Next: Ghambar

All groups using tool Gh0st RAT

ChangedNameCountryObserved

APT groups

 Anchor Panda, APT 14China2012 
XAPT 17, Deputy Dog, Elderwood, Sneaky PandaChina2009-Sep 2017 
 APT 18, Dynamite Panda, WekbyChina2009-May 2016 
 APT 31, Judgment Panda, ZirconiumChina2016 
XAPT 41China2012-Aug 2020X
 Axiom, Group 72China2008-2008/2014 
XBronze Butler, Tick, RedBaldNight, Stalker PandaChina2010-Jun 2019 
 Dust StormChina2010 
XEmissary Panda, APT 27, LuckyMouse, Bronze UnionChina2010-Jun 2020 
 GhostNet, Snooping DragonChina2009-2010X
XKimsuky, Velvet ChollimaNorth Korea2012-Mar 2020X
XLazarus Group, Hidden Cobra, Labyrinth ChollimaNorth Korea2007-Dec 2020 HOTX
 Leviathan, APT 40, TEMP.PeriscopeChina2013-Jan 2020 
 MikroceenChina2017 
 Nitro, Covert GroveChina2011-Jul 2014 
 PassCVChina2016 
 PittyTiger, Pitty PandaChina2011-2014 
 RedAlphaChina2015-2017 
 Roaming TigerChina2014-Aug 2015 
XStone Panda, APT 10, menuPassChina2006-Jul 2020X
 TA459China2017 
XWicked Spider, APT 22China2018 

22 groups listed (22 APT, 0 other, 0 unknown)

↑

Thailand Computer Emergency Response Team (ThaiCERT)
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents
Telephone +66 (0)2-123-1234
E-mail report@thaicert.or.th
PGP Download PGP key