> Family · gh0st_

~/packetpursuit $ cat /intel/families/gh0st.md

typeentityconfidencelowcreated2026-06-14updated2026-06-14ratmalware-familypec2mitre-attck

gh0st

Confidence: LOW — The gh0st / gh0strat / gh0stkcp labels in this corpus are MalwareBazaar heuristic tags. At least two distinct build stacks are present: a classic MFC/Win32 variant (not yet deeply analysed here) and a Qt6-based x64 rebuild (sample e65bbcad). Do not treat this as a confirmed single family until more samples are clustered.

Overview

Gh0st RAT is a historic Chinese-origin remote-access trojan first observed circa 2008. The original source code leaked years ago and has been forked, rebranded, and rebuilt countless times. OpenCTI / MalwareBazaar tags gh0st, gh0strat, and gh0stkcp appear on samples in this corpus, but static analysis reveals divergent build stacks — suggesting either a modernized fork or co-labeled unrelated families.

Build-stack variants observed

Variant Toolchain Sample Notes
Qt6 rebuild MSVC 14.50 + Qt 6.4.3 static e65bbcad 3.7 MB, nonsense version-info, 759 KB encrypted .rsrc blob ^[raw/analyses/e65bbcad/report.md]
Classic (inferred) MFC / Win32 C++ cd723423, af71d888, fdaabbf7, baa25e93, 03dae377, 17fc02be Tagged gh0st/gh0strat by MalwareBazaar; not yet deeply analysed
KCP variant Unknown 0896fae8, 8d33791e Tagged gh0stkcp; KCP is a UDP-based reliable transmission library often paired with Gh0st

Deploy / TTPs (Qt6 variant — preliminary)

  • T1055 — Process Injection: imports WriteProcessMemory, VirtualAllocEx, OpenProcess, CreateThread ^[raw/analyses/e65bbcad/report.md]
  • T1071.001 — Application Layer Protocol: WSAAsyncSelect + Qt networking stack ^[raw/analyses/e65bbcad/report.md]
  • T1547.001 — Registry Run Keys: RegCreateKeyExW, RegSetValueExW imported ^[raw/analyses/e65bbcad/report.md]
  • T1573.001 — Encrypted Channel: 759 KB obfuscated .rsrc blob likely carries encrypted C2 config ^[raw/analyses/e65bbcad/report.md]
  • T1036.002 — Masquerading: nonsense version-info strings (YTqohOxsDzV) ^[raw/analyses/e65bbcad/report.md]

Capabilities

  • qt6-static-gui-rat-framework
  • runtime-encrypted-rsrc-payload
  • process-injection-win32-apis
  • registry-persistence
  • async-socket-event-loop
  • version-info-nonsense-masquerade
  • rpcrt4-async-client-calls

Variants / Aliases

  • gh0st (MalwareBazaar)
  • gh0strat (MalwareBazaar — likely same family, tag variant)
  • gh0stkcp (MalwareBazaar — KCP transport variant)

Notable analyses

  • /intel/analyses/e65bbcad9624099ad3de706e3714fb4e32455038c3a133b03e9da9af4257b811.html — Qt6 x64 rebuild, deep static analysis (this dive)
  • cd723423, af71d888, fdaabbf7, baa25e93, 03dae377, 17fc02be — Classic-tagged siblings awaiting deep analysis
  • 0896fae8, 8d33791e — gh0stkcp tagged siblings awaiting deep analysis

Related entities

  • version-info-masquerade — Build technique observed in the Qt6 variant
  • quasar — Another open-source RAT family with comparable commodity RAT TTPs
  • asyncrat — .NET RAT with modular plugin architecture; similar market segment