H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Malware

gh0st RAT

[gh0st RAT](https://attack.mitre.org/software/S0032) is a remote access tool (RAT). The source code is public and it has been used by multiple groups.(Citation: FireEye Hacking Team)(Citation: Arbor Musical Chairs Feb 2018)(Citation: Nccgroup Gh0st April 2018)

Malware
TypeMalware
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

[gh0st RAT](https://attack.mitre.org/software/S0032) is a remote access tool (RAT). The source code is public and it has been used by multiple groups.(Citation: FireEye Hacking Team)(Citation: Arbor Musical Chairs Feb 2018)(Citation: Nccgroup Gh0st April 2018)

Labels

malware
36 recorded

Relationships

uses
from Andariel
Group
uses
from APT18
Group
uses
from APT41
Group
uses
from APT5
Group
uses
from Axiom
Group
uses
to Clear Windows Event Logs
Technique
uses
to Command and Scripting Interpreter
Technique
uses
to Deobfuscate/Decode Files or Information
Technique
uses
to DLL
Technique
uses
to Encrypted Channel
Technique
uses
to Fast Flux DNS
Technique
uses
to File Deletion
Technique
uses
to Ingress Tool Transfer
Technique
uses
to Keylogging
Technique
uses
to Modify Registry
Technique
uses
to Native API
Technique
uses
to Non-Application Layer Protocol
Technique
uses
to Process Discovery
Technique
uses
to Process Injection
Technique
uses
to Query Registry
Technique
uses
to Registry Run Keys / Startup Folder
Technique
uses
to Rundll32
Technique
uses
to Screen Capture
Technique
uses
to Service Execution
Technique
uses
to Shared Modules
Technique
uses
to Standard Encoding
Technique
uses
to Symmetric Cryptography
Technique
uses
to System Information Discovery
Technique
uses
to Windows Service
Technique
uses
from Higaisa
Group
uses
from Kimsuky
Group
uses
from Leviathan
Group
uses
from Operation Dust Storm
Campaign
uses
from PittyTiger
Group
uses
from TA459
Group
uses
from Threat Group-3390
Group
8 external

References

mitre-attack
S0032
open
gh0st RAT
—
Mydoor
—
Moudoor
—
FireEye Hacking Team
https://www.fireeye.com/blog/threat-research/2015/07/demonstrating_hustle.html
open
Novetta-Axiom
https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf
open
Nccgroup Gh0st April 2018
https://research.nccgroup.com/2018/04/17/decoding-network-data-from-a-gh0st-rat-variant/
open
Arbor Musical Chairs Feb 2018
https://www.arbornetworks.com/blog/asert/musical-chairs-playing-tetris/
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance