What Is gh0st RAT? How It Works, Spreads, and Steals Data

Introduction to gh0st RAT

Ghost RAT (Remote Access Trojan) is a type of sophisticated malicious software that operates covertly, enabling unauthorized remote access and control of a victim’s computer system. Often deployed with malicious intent by cybercriminals, Ghost RATs are designed to evade detection and provide the attacker with a range of powerful capabilities, such as data theft, system manipulation, and surveillance. By exploiting vulnerabilities in security defenses, Ghost RAT malware can compromise the integrity and confidentiality of sensitive information, posing significant threats to both individuals and organizations alike. Understanding the inner workings of Ghost RAT malware is essential for safeguarding against its detrimental effects and fortifying cybersecurity measures in an ever-evolving digital landscape.

Delivery Methods of gh0st RAT

Lacking an out-of-the-box distribution method, recently observed Redline incidents appear to begin with the delivery of malicious document attachments sent via an indiscriminate unsolicited email (malspam) campaign, Twitter, and Instagram Direct Messaging. Mostly targeting service or content providers individuals such as 3D artists and streamers, financial advisers, and more based mostly in North America and Europe.

In addition, The malware is spread through YouTube videos that lure victims into downloading a fake bot to automatically buy Binance NFT Mystery Boxes.

Another delivery method is via Discord communities which leads to the download of malicious file that loads Redline into memory.

Gh0st RAT consists of two primary components: the client and the server.

Client (Controller Application): Often referred to as the “client,” this is a Windows-based application used to manage and control Gh0st servers deployed on compromised remote systems. Its two key functions are:

1. Overseeing the operation of Gh0st server instances.
2. Creating custom server installation packages for deployment.
3. Server (Windows DLL – User-Level Binary): The server component is implemented as a Windows DLL named SVCHOST.DLL, which is installed as a Windows service on the infected machine. Once active, it connects to the Gh0st client and waits for further commands. This DLL is deployed and installed via a dropper application named SERVER.EXE, which automates its setup as a persistent service.
4. Dropper (INSTALL.EXE): This stand-alone Windows application is responsible for installing SVCHOST.DLL. It includes all the necessary logic to prepare a host for infection, install the Gh0st RAT server component, and launch it as a Windows service.
5. Kernel-Level Component (RESSDT.SYS): RESSDT.SYS is the only kernel-mode binary in the Gh0st toolset. It is a minimal device driver whose sole function is to reset the System Service Dispatch Table (SSDT). It executes at system startup to remove any SSDT hooks, thereby helping evade detection or interference.
6. Installer (Dropper Program): Commonly referred to simply as the “dropper,” this program bundles both the user-level and kernel-level binaries. It performs all the necessary actions to install the Gh0st server on a target machine and initiate the malicious service.

Impact of gh0st RAT

It collects various information from browsers, such as saved credentials, autocomplete data, and credit card information, as well as A system information of the target machine, that includes username, geo-location, hardware configuration, and installed software.

Recent versions of RedLine has the ability to steal cryptocurrency, FTP and IM clients information.

About Check Point Exposure Management

Check Point Exposure Management is an intelligence-led, validation-driven, remediation-first unified platform that helps security teams move quickly and safely from exposure visibility to exposure reduction. Delivered through a single UI, it brings together threat intelligence, exposure prioritization, Agentic Exposure Validation, and safe remediation so teams can understand risk, prove exploitability, and act from one place.

gh0st RAT TTPS

gh0st RAT IOCs (Sample of 50)