software

gh0st RAT

activeentity:software

[gh0st RAT](https://attack.mitre.org/software/S0032) is a remote access tool (RAT). The source code is public and it has been used by multiple groups.(Citation: FireEye Hacking Team)(Citation: Arbor Musical Chairs Feb 2018)(Citation: Nccgroup Gh0st April 2018)

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: gh0st-rat
kind: software
status: active
aliases: Moudoor · Mydoor
jurisdictions: —
claims naming it: 0 · 0 attributions · 11 relations · 0 events

Identifiers

attack S0032via mitre-attack

Relations

MITRE ATT&CK Enterpriserecords thatKimsukyusesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_42btcintel:relations:42@v1 sha256:360b4681a660f91d
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT41usesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_67btcintel:relations:67@v1 sha256:80d67f3484e57acc
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT18usesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_189btcintel:relations:189@v1 sha256:4d83871e0945d1e5
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAndarielusesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_193btcintel:relations:193@v1 sha256:452761f1f3696c92
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatHigaisausesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_277btcintel:relations:277@v1 sha256:5bef3932a2e6cf85
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatTA459usesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_293btcintel:relations:293@v1 sha256:95ae39f0a1305116
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatLeviathanusesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_329btcintel:relations:329@v1 sha256:e6fa7ebd0ce07a00
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAxiomusesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_453btcintel:relations:453@v1 sha256:0df45c90dc144154
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatAPT5usesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_522btcintel:relations:522@v1 sha256:382b2cc5cb589718
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatThreat Group-3390usesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_646btcintel:relations:646@v1 sha256:02a7a8fd522441df
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatPittyTigerusesgh0st RAT
fetch —sha256 dc1639caa5501d72
rel_668btcintel:relations:668@v1 sha256:f915f60d4d6a034a
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.