Upon execution, the very first thing the sample does is use its C2 URL to create a mutex (z-hacker-ywin). These 2 exploits are EternalBlue/Doublepulsar and are used to drop the sample onto a system. Just like in part 1, these were the 2 exploits used to drop the sample on my honeypot: Additionally, this is a dynamic DNS, meaning the IP has changed, however here are some of the IP’s I have seen Interestingly, this sample communicates with its C2 server (z-hacker-ywin) over port 22, which is the port typically reserved for SSH. Typically, ‘Gh0st’ occurs in the first 5 bytes of the header, before the size fields, not after.

It uses unique opcodes, unique commands, and while on first glance the header appears normal, it has actually been modified. In fact, on first glance, you’ll see that its network traffic even contains ‘Gh0st’. Its strings are not encrypted and it doesn’t use any DLL’s loaded into memory/dropped. On first glance, this sample seems to be a fairly simple and unaltered Gh0stRAT sample. In 30s, 1,237,749 packets were sent with a total of 352Mbits/second.Īdditionally, this blog post will also be expanding on my redirection technique, along with more information on how Gh0strat handles commands. ICMP DDOS from my computer to my other computer.

Adding a new net user and installing registry keys for RDP.

Multithreaded DDOS using TCP/UDP/HTTP/ICMP.

Some of the key functionality of the sample includes: Additionally, once control is gained, the hacker can use unique commands in this Gh0stRAT sample to Denial of Service (“DDoS”) a target. In part 2, we will be talking about a much more complete Gh0stRAT sample which allows a hacker to take total control over a victim’s computer. In Part 1 of the Reversing Gh0stRAT series, we talked about a partial Gh0stRAT variant which used an encryption algorithm to hide its traffic. This is a guest post James Quinn, a SOC analyst from Binary Defense.

Ddos minecraft server cmd