gh0st: e65bbcad — Qt6 x64 RAT with encrypted payload blob, March 2026

Executive Summary

PE32+ x64 GUI executable (~3.7 MB) built with MSVC 14.50 and Qt 6.4.3 framework, compiled March 2026. MalwareBazaar tags it gh0st/gh0strat; static evidence supports a commodity remote-access trojan (RAT) using Qt6 for its GUI layer and networking, with a 759 KB encrypted/compressed payload embedded inside .rsrc. No hardcoded C2 IOCs recovered statically. Version-info masquerade with nonsense strings. Unsigned. Dynamic analysis unavailable (no CAPE Windows guest). Family attribution is preliminary — the Qt6 build stack diverges from classic MFC-based Gh0st RAT.

What It Is

Version-info masquerade

VS_VERSIONINFO fields populated with nonsense alphanumeric strings rather than a legitimate vendor identity ^[exiftool.json]:

• CompanyName: NXKIhbBI
• FileDescription: YTqohOxsDzV
• ProductName: YTqohOxsDzV
• OriginalFileName: YTqohOxsDzV.exe
• FileVersion: 10.7.4207.461

This is a masquerading tactic (T1036.002) — the fields are not blank, but they carry no semantic meaning, likely to defeat simplistic reputation checks that flag empty metadata. See version-info-masquerade.

How It Works

Entry point

Standard MSVC C++ startup chain: entry → __scrt_common_main_seh → FUN_14019de80 (likely main or WinMain equivalent) ^[ghidra:entry-140160b58]. The Qt event loop (QCoreApplication::exec) is referenced in strings, indicating a GUI-driven RAT rather than a headless service ^[strings.txt:2806].

Embedded payload blob

Inside .rsrc (raw offset 0x2CCF16, virtual 0x140388000+) sits a 759,434-byte blob with no recognizable magic header. XOR brute-force (keys 0x00–0xFF) against the first 100 bytes did not yield a PE, DOS stub, or zlib header. Entropy is 5.68 — below encrypted randomness (~7.8) but above structured plaintext (~4.0), suggesting compressed or lightly obfuscated content ^[terminal:embedded-entropy].

The blob begins:

3c 37 00 00 00 00 00 37 53 38 53 00 00 00 00 00

Repeated ?? 53 bytes resemble a size/offset table or a custom archive index. This is likely either:

1. A Qt resource archive (.rcc) containing the RAT's configuration, modules, or secondary payload.
2. A custom encrypted payload decrypted at runtime by the main binary.

Without dynamic execution or a matching Qt .rcc parser, full extraction is not possible statically.

Network capability

• WS2_32.dll.WSAAsyncSelect is imported, allowing asynchronous socket event handling tied to a Win32 window message loop — consistent with a GUI RAT that uses Qt's networking stack ^[pefile.txt].
• RPCRT4.dll imports present (RPC string binding, async client calls) ^[pefile.txt].
• No hardcoded IP, domain, or URL strings recovered from static analysis. C2 configuration is likely encrypted inside the embedded blob or resolved at runtime.

Process / memory manipulation

• KERNEL32.dll.WriteProcessMemory, VirtualAllocEx, OpenProcess, CreateThread, ResumeThread — standard cross-process injection and thread-manipulation toolkit ^[pefile.txt].
• ADVAPI32.dll registry imports (RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegQueryValueExW) support persistence and configuration storage ^[pefile.txt].

Anti-analysis

• No overt anti-debug strings (no IsDebuggerPresent check observed in decompiled entry, though it is imported).
• No VM-detection strings.
• Large Qt6 runtime bloat (~2+ MB of Qt strings and ICU tables) hinders manual string review by drowning malicious indicators in framework noise.

Decompiled Behavior

Ghidra loaded the binary at x86:LE:64:default with 4,859 functions and 5,140 symbols. Auto-analysis is incomplete (code indexing pending), so decompilation is limited to the entry/startup layer.

Entry (0x140160b58)

• Calls FUN_1401614a0 (likely C-runtime pre-initialization).
• Calls __scrt_common_main_seh which sets up the C++ exception frame, runs initterm initializers, then calls FUN_14019de80 with uVar8 = _get_narrow_winmain_command_line() and window-mode flag uVar4 ^[ghidra:__scrt_common_main_seh-1401609e4].

Main-equivalent (FUN_14019de80)

• Not decompiled in this pass (auto-analysis incomplete). The function address 0x14019de80 sits in .text and is referenced only from the startup path.

C2 Infrastructure

Static assessment: runtime-resolved. No hardcoded network IOCs were recovered from strings, imports, or the decompiled entry path. The 759 KB .rsrc blob is the most likely C2 config carrier. Without dynamic detonation or a decrypted blob, specific IPs, domains, ports, or mutex names cannot be stated.

Interesting Tidbits

1. Qt6 is unusual for Gh0st — Classic Gh0st RAT and its early variants are MFC/Win32 C++. A Qt6-based rebuild suggests a modernized fork or a different family co-labeled by MalwareBazaar heuristic.
2. Nonsense version-info — YTqohOxsDzV / NXKIhbBI are not random keyboard mash; they may be generated by a builder that produces pronounceable-but-meaningless strings to evade "blank metadata" heuristics.
3. No .NET, no Go, no Rust — This is a straightforward native C++ binary with a major commercial framework, making it statically large but behaviorally conventional.
4. No CAPE detonation — The Windows guest is missing; runtime behavior (actual C2 beacon, registry writes, dropped files) is unknown.

How To Mess With It (Homelab Replication)

Goal: Build a minimal Qt6 GUI executable that statically links Qt and produces a comparable capa/PE fingerprint.

1. Install Qt 6.4.3 (open-source offline installer) on a Windows VM.
2. Build a minimal QApplication + QTcpSocket project in Qt Creator:

   #include <QApplication>
   #include <QTcpSocket>
   int main(int argc, char *argv[]) {
       QApplication a(argc, argv);
       QTcpSocket s;
       s.connectToHost("127.0.0.1", 4444);
       return a.exec();
   }
   

3. Compile statically: qmake CONFIG+=static or cmake -DQT_BUILD_STATIC=ON.
4. Verify with file → should read PE32+ executable (GUI) x86-64.
5. Compare strings output — expect massive Qt/ICU string pollution similar to this sample.

What you'll learn: How Qt6 static linking inflates binaries and obscures malicious strings, and why RAT authors might choose Qt for cross-platform GUI reuse.

Deployable Signatures

YARA rule

rule GH0ST_Qt6_RAT_Prelim {
    meta:
        description = "Preliminary static signature for Qt6-based Gh0st-labeled RAT (static-only, no dynamic confirmation)"
        author = "Titus / PacketPursuit"
        date = "2026-06-14"
        sha256 = "e65bbcad9624099ad3de706e3714fb4e32455038c3a133b03e9da9af4257b811"
    strings:
        $qt_core = "QCoreApplication::exec: The event loop is already running" wide ascii
        $qt_thread = "QThread: Destroyed while thread is still running" wide ascii
        $qt_sock = "QSocketNotifier: Multiple socket notifiers for same socket" wide ascii
        $qt_logging = "qt.core.logging" wide ascii
        $wsa = "WSAAsyncSelect" ascii
        $ver1 = "YTqohOxsDzV" wide ascii
        $ver2 = "NXKIhbBI" wide ascii
    condition:
        uint16(0) == 0x5A4D and
        filesize > 3MB and filesize < 5MB and
        3 of ($qt_*) and
        ($wsa or $ver1 or $ver2)
}

Sigma rule

Not applicable statically — no observed process-tree, registry, or file-creation behavior without CAPE detonation. Runtime Sigma would require:

• Q*.exe process spawning child processes with WriteProcessMemory/CreateRemoteThread
• Unexpected Qt6 GUI application making outbound TCP connections to non-local addresses
• Registry writes to Run keys by a process with Qt strings in its image

IOC list

Behavioral fingerprint statement

This binary is a ~3.7 MB PE32+ x64 GUI application statically linked with Qt 6.4.3. It imports WSAAsyncSelect for network event handling and carries the full Win32 process-injection toolkit (WriteProcessMemory, VirtualAllocEx, OpenProcess). A 759 KB obfuscated blob sits inside .rsrc and is likely decrypted at runtime to reveal C2 configuration or additional modules. No hardcoded network IOCs are visible statically. The version-info block contains nonsense masquerade strings. When detonated, expect a Qt GUI window, outbound TCP connection to a runtime-resolved endpoint, and possible child-process injection.

Detection Signatures

All confidence levels reduced by one tier because CAPE detonation was unavailable.

References

• MalwareBazaar entry: e65bbcad9624099ad3de706e3714fb4e32455038c3a133b03e9da9af4257b811 (tags: gh0st, gh0strat) ^[triage.json]
• gh0st — Family entity page
• version-info-masquerade — Masquerading technique

Provenance

Analysis produced from static artefacts only. Tools: file (file type), exiftool (metadata), pefile/rabin2 (PE structure), Ghidra (decompilation, symbols, strings — auto-analysis incomplete), strings (plaintext extraction), floss (no decoded strings recovered), capa (failed — missing signatures), binwalk (no embedded archives), CAPE (skipped — no Windows guest). Dynamic behavior is inferred from imports and framework choice, not observed. Family attribution (gh0st) is preliminary and sourced from MalwareBazaar tags; the Qt6 build stack diverges from classic Gh0st RAT MFC/Win32 heritage.