ANGRYREBELMalware
- farfli
- Gh0st RAT
- Ghost RAT
- moudoor
- mydoor
- pcrat
According to Security Ninja, Gh0st RAT (Remote Access Terminal) is a trojan “Remote Access Tool” used on Windows platforms, and has been used to hack into some of the most sensitive computer networks on Earth. Below is a list of Gh0st RAT capabilities. Take full control of the remote screen on the infected bot. Provide real time as well as offline keystroke logging.From MISP Galaxy
Last reported 10 days ago, by Sekoia.io5 reports
ATT&CK techniques
6 of 25 · each with the sentence it comes from- T1036Masquerading
“Masquerading as Russian hackers”
- T1014Rootkit
“…e the leak of ValleyRAT builder in 2023, the intrusion set continued to use it, exploiting zero-day driver plugin and using kernel-mode rootkit likely for intelligence collection.”
- T1033System Owner/User Discovery
“System Owner/User Discovery”
- T1055Process Injection
“RONINGLOADER takes a different approach to this process injection compared to other injection methods used elsewhere in the malware.”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“Input Capture: Keylogging”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Sekoia Honeypot Captures an Attack on GenAI Infrastructure“…nline casinos, and betting sites, relying on multiplatform malware families historically attributed to Chinese-speaking actors (PlugX, Gh0st RAT, PuppetLoader).”
-
Silver Fox: The only Tax Audit Where Fine Print Installs Malware“In addition, Silver Fox relies on other malicious payloads like HoldingHands, which is a variant of Gh0st RAT.”
-
RONINGLOADER: DragonBreath’s New Path to PPL Abuse“Elastic Security Labs identified a recent campaign distributing a modified variant of the gh0st RAT, attributed to the Dragon Breath APT (APT-Q-27), through trojanized NSIS installers masquerading as legitimate software such as Google Chrome and Microsoft Teams.”
-
The Crown Prince, Nezha“Questions still remain as to why someone with these intentions would deploy Ghost RAT on an endpoint, or would have the majority of systems under their control in locations which have direct geopolitical conflict with Mainland China; however, one thing is for sure, no matter the…”
-
LAZARUS ARISEN“… screen behind the host, Group-IB specialists noticed two IP addresses 175.45.178.19 and 175.45.178.97, which had been used to control Ghost RAT malware.”
Indicators in its reports
named in the reports above- e2b75baeb7ed21fb…167bd24ba6dcin 1 report
- hxxps://6-1321729461.cos.ap-guangzhou.myqcloud[.]com/lnstaller.msiin 1 report
- hxxps://00-1321729461.cos.ap-guangzhou.myqcloud[.]com/2024.7zin 1 report
- 9010.360sdgg[.]comin 1 report
- googlevip[.]icuin 1 report
- oytdwzz[.]shopin 1 report
- andyvxyngw[.]cnin 1 report
- f9eaab0f05bd38a2…86ca7ceddce8in 1 report
- 154.201.87[.]75in 1 report
- 154.201.87[.]124in 1 report
- hxxps://xqwmwru[.]top/upload_large.phpin 1 report
- xqwmwru[.]topin 1 report
- hxxps://xqwmwru[.]top/upload_status.phpin 1 report
- 115.187.17[.]212in 1 report
- 112.121.183[.]102in 1 report
- 156.251.18[.]45in 1 report
- 206.238.178[.]116in 1 report
- 112.213.120[.]164in 1 report
- 47.85.99[.]19in 1 report
- 216.250.104[.]166in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.