MITRE ATT&CKsoftware (malware)

S0032 gh0st RAT

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Windows, macOS
Aliases
Mydoor, Moudoor
Version
3.3
Created
2017-05-31

Description

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

Related

Uses · MITRE ATT&CK (24)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1573 Encrypted Channel technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1574.001 DLL sub-technique
  • T1568.001 Fast Flux DNS sub-technique
  • T1569.002 Service Execution sub-technique
  • T1056.001 Keylogging sub-technique
  • T1070.004 File Deletion sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1012 Query Registry technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1059 Command and Scripting Interpreter technique
  • T1082 System Information Discovery technique
  • T1095 Non-Application Layer Protocol technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1112 Modify Registry technique
  • T1113 Screen Capture technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (12)

References