Gh0stRAT
Released 16 years, 10 months ago. January 2008
Copyright © MegaSecurity
By C.Rufus Security Team
Informations
| From | China |
| Author | C.Rufus Security Team |
| Family | Ghost |
| Category | Remote Access |
| Version | Gh0stRAT |
| Released Date | Jan 2008, 16 years, 10 months ago. |
Additional Information
Server:
Dropped File:
c:\WINDOWS\system32\tcpapi32.dll
Size: 121,856 bytes
Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_IAS\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ias\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ias\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ias\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\C
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_IAS\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ias\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ias\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Ias\Security
Tested on Windows XP
February 02, 2008If you recognize any personal information on this page and wish to have it removed or redacted, please contact us at jplesueur@phrozen.io. We are committed to protecting your privacy in accordance with GDPR regulations.