Malware analysis
COMMAND_KILLPROCESS
COMMAND_SESSION
COMMAND_DELETE_FILE
COMMAND_DELETE_DIRECTORY
COMMAND_SYSTEM
COMMAND_AUDIO
COMMAND_WEBCAM
COMMAND_OPEN_URL_HIDE
COMMAND_REPLAY_HEARTBEAT
COMMAND_UPDATE_SERVER
COMMAND_ACTIVED
TOKEN_AUTH
TOKEN_HEARTBEAT
TOKEN_LOGIN
TOKEN_FILE_SIZE
TOKEN_DRIVE_LIST
TOKEN_TRANSFER_FINISH
TOKEN_DATA_CONTINUE
TRANSFER_MODE_NORMAL
TRANSFER_MODE_JUMP
TRANSFER_MODE_CANCEL
TRANSFER_MODE_OVERWRITE
TRANSFER_MODE_CANCEL
Gh0st RAT Part 2: Packet Structure and Defense Measures
We have seen in Part 1 of this series how sophisticated Gh0st RAT is and how difficult it is to identify this attack because of the variants it comes in.
In this article we will learn how communication between Gh0st components actually takes place. At the end of the article we will see some of the measures that, if adopted, can provide some good defensive measures against a Gh0st attack.
Become a certified reverse engineer!
Get live, hands-on malware analysis training from anywhere, and become a Certified Reverse Engineering Analyst.
Gh0st RAT – Data Packet Structure
Below is the packet information that is exchanged between a Ghost RAT client and a compromised host.
- Packet Header: 5 byte length and it contains the Gh0st magic keywords. Magic keywords are indicated in Part 1 of this series.
- Packet Size: 4 byte integer to determine the total size of the packet.
- 4 byte integer that contains the size of packet when uncompressed.
- Variable size payload data that contain commands exchanged between client and host.
It is important to note that the Ghost header is sent in clear text and the packet payload is compressed using the open zlib compression library. The encrypted payload can be easily decrypted using the zlib module unencrypt() function. The payload contains operation codes like commands, tokens and modes, which are exchanged between the Gh0st RAT c2 client and compromised host.
Some of the important operation codes are as shown below.
Commands
Token Codes
Modes
Defensive Measures
The below section will list out some of the defensive and proactive measures that can be put in place to detect Gh0st Malware.
-
Monitoring traffic with inline network devices: Security solutions which provide deep packet monitoring such as Intrusion Detection/Prevention Systems (IDS/IPS) can help a great deal in looking for Gh0st malware. But today the Gh0st Malware is so sophisticated that a simple signature in the IDS/IPS is not enough to detect Gh0st malware.
-
Internal port scans: As we have learned that there is a persistent connection between the Gh0st RAT c2 client and compromised host, running an internal port scan at regular intervals will reveal out the malicious ports.
-
Monitoring services on hosts: Since malware is usually installed as root kits and operates closer to the kernel layer, and mostly malware installed as services, an internal scan must be carried on all the running services on hosts at regular intervals.
-
Event logs for hosts: End point host event logs must be monitored for both successful and failed logins. Specifically monitor for logon type 3 and 10, because these are most possible ways in which an intruder can connect to the internal hosts.
- Last but not least, security awareness is a must to prevent against most malwares, and Gh0st RAT is no exception. Users should be aware of these malwares to protect against attacks such as URL redirection.
References
Enroll in a Reverse Engineering Malware Boot Camp and become a Certified Reverse Engineering Analyst — guaranteed!
- Exam Pass Guarantee
- Live expert instruction
- Hands-on labs
- CREA exam voucher
In this Series
- Gh0st RAT Part 2: Packet Structure and Defense Measures
- How AsyncRAT is escaping security defenses
- Chrome extensions used to steal users' secrets
- Luna ransomware encrypts Windows, Linux and ESXi systems
- Bahamut Android malware and its new features
- LockBit 3.0 ransomware analysis
- AstraLocker releases the ransomware decryptors
- Analysis of Nokoyawa ransomware
- Goodwill ransomware group is propagating unusual demands to get the decryption key
- Dangerous IoT EnemyBot botnet is now attacking other targets
- Fileless malware uses event logger to hide malware
- Nerbian RAT Using COVID-19 templates
- Popular evasion techniques in the malware landscape
- Sunnyday ransomware analysis
- 9 online tools for malware analysis
- Blackguard malware analysis
- Behind Conti: Leaks reveal inner workings of ransomware group
- ZLoader: What it is, how it works and how to prevent it | Malware spotlight [2022 update]
- WhisperGate: A destructive malware to destroy Ukraine computer systems
- Electron Bot Malware is disseminated via Microsoft's Official Store and is capable of controlling social media apps
- SockDetour: the backdoor impacting U.S. defense contractors
- HermeticWiper malware used against Ukraine
- MyloBot 2022: A botnet that only sends extortion emails
- Mars Stealer malware analysis
- How to remove ransomware: Best free decryption tools and resources
- Purple Fox rootkit and how it has been disseminated in the wild
- Deadbolt ransomware: The real weapon against IoT devices
- Log4j - the remote code execution vulnerability that stopped the world
- Rook ransomware analysis
- Modus operandi of BlackByte ransomware
- Emotet malware returns
- Mekotio banker trojan returns with new TTP
- Android malware BrazKing returns
- Malware instrumentation with Frida
- Malware analysis arsenal: Top 15 tools
- Redline stealer malware: Full analysis
- A full analysis of the BlackMatter ransomware
- A full analysis of Horus Eyes RAT
- REvil ransomware: Lessons learned from a major supply chain attack
- Pingback malware: How it works and how to prevent it
- Android malware worm auto-spreads via WhatsApp messages
- Malware analysis: Ragnarok ransomware
- Taidoor malware: what it is, how it works and how to prevent it | malware spotlight
- SUNBURST backdoor malware: What it is, how it works, and how to prevent it | Malware spotlight
- ZHtrap botnet: How it works and how to prevent it
- DearCry ransomware: How it works and how to prevent it
- How criminals are using Windows Background Intelligent Transfer Service
- How the Javali trojan weaponizes Avira antivirus
- HelloKitty: The ransomware affecting CD Projekt Red and Cyberpunk 2077
- DreamBus Botnet: An analysis
- Kobalos malware: A complex Linux threat
Get certified and advance your career
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, (ISC)², Cisco, Microsoft and more!
Malware analysis
Malware analysis
Malware analysis
Malware analysis