gh0st RAT

Malware & Tools · gh0st RAT

· MalwareS0032 · Zararlı Yazılım

Type

malware

Techniques

Used By

11 groups

Platforms

Windows, macOS

Description

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.(Citation: FireEye Hacking Team)(Citation: Arbor Musical Chairs Feb 2018)(Citation: Nccgroup Gh0st April 2018)

Tactic Coverage

command and control (6)stealth (5)execution (5)discovery (3)privilege escalation (3)persistence (3)collection (2)defense impairment (2)credential access (1)

Used By (11 groups)

G0026APT18TG-0416, Dynamite Panda G0096APT41Wicked Panda, Brass Typhoon G1023APT5Mulberry Typhoon, MANGANESE G0138AndarielSilent Chollima, PLUTONIUM G0001AxiomGroup 72 G0126Higaisa G0094KimsukyBlack Banshee, Velvet Chollima

Techniques (24)

T1012Query Registry

discovery

T1055Process Injection

stealthprivilege escalation

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1059Command and Scripting Interpreter

execution

T1070.004File Deletion

stealth

References

https://attack.mitre.org/software/S0032 https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/https://www.arbornetworks.com/blog/asert/musical-chairs-playing-tetris/