> Family · gh0strat_

~/packetpursuit $ cat /intel/families/gh0strat.md

typeentityfamilygh0stratconfidencelowmalware-familyratloaderc2inno-setupdelphidropper

gh0strat

A tentative malware-family label from OpenCTI and MalwareBazaar, co-applied to samples also tagged silverfox and valleyrat. The relationship between gh0strat, silverfox, and valleyrat is unconfirmed — they may be the same family under different naming conventions, a fork, or distinct families sharing infrastructure or detection artefacts.

The name gh0strat suggests a connection to the historic gh0st RAT family (Chinese-origin, MFC/Win32, also tagged gh0stkcp in MalwareBazaar). No code reuse, shared build artefacts, or common C2 infrastructure has been identified between the confirmed gh0strat sample and known gh0st samples. The tag may be a detection artefact or a campaign-level umbrella rather than a true family.

Overview

Attribute Detail
Platform Windows (PE32)
Build variants Inno Setup 6.5.7.1 Delphi dropper (confirmed: fdaabbf7) — encrypted LZMA overlay, no code signing, masquerade as ByteDance Doubao AI assistant
Labels gh0strat, silverfox, valleyrat (co-tagged)
Confidence Low — single confirmed sample; no payload extraction; no dynamic analysis

Capabilities

  • inno-setup-delphi-encrypted-overlay-dropper
  • lzma-compressed-payload-embedding
  • version-info-masquerade
  • filename-social-engineering (Chinese product impersonation)
  • no-code-signing
  • installer-stub-payload-opaque (standard Inno stub with malicious overlay)

Notable Analyses

  • fdaabbf7b7585cc473502c21a1471f95de45d5492216e8e6c035e1856d6af9b1 — Inno Setup 6.5.7.1 PE32, Delphi 36.0, 豆包.exe Doubao masquerade, 4.6 MB LZMA overlay, VersionInfo Microsoft Corpora / Engine Direct Turbo Setup. Static-only. No payload recovered.

Related Entities

  • silverfox — multi-variant loader/RAT cluster with Rust, C, .NET Native AOT, and driver-dropper builds. Co-tagged gh0strat/valleyrat.
  • valleyrat — tentative OpenCTI label for Inno Setup and .NET Native AOT variants co-labeled with SilverFox. Includes a confirmed Inno Setup 7.0.0.1 dropper (480c184e).
  • gh0st — historic Chinese-origin RAT family (MFC/Win32). The gh0strat tag may be derived from this family name, but no technical link has been established.