Gh0St
Overview
Gh0st RAT is a long-standing, modular Remote Access Trojan (RAT) that has been active since at least 2008. Because its source code is publicly available, numerous threat actors have modified and deployed it, making it a persistent and frequently encountered threat. Gh0st RAT provides attackers with full, interactive control over an infected system, including remote desktop access, keystroke logging, webcam/microphone hijacking, and file management. Modern campaigns often deliver Gh0st RAT through sophisticated methods like fake installers, spam emails, and malicious loaders, using techniques like DLL sideloading to bypass security controls.
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_GH0ST {
meta:
description = "Detects Gh0St (rat)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "gh0st" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Gh0St Activity
id: e9679963a2c22de9032e8000338997dc
status: experimental
description: Detects generic indicators of the gh0st malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*gh0st*"
condition: selection
level: mediumReferences & External Analysis
- Search "gh0st" on VirusTotal (External Analysis)
Frequently Asked Questions
What is Gh0st RAT?
Gh0st RAT is a widely distributed Remote Access Trojan that allows attackers to take full control over a victim's computer, including screen sharing, keylogging, and file manipulation.
How is Gh0st RAT typically deployed?
It is commonly spread via spam and phishing emails, fake software installers, and malicious loaders that may bundle the RAT with other threats like adware.
Why is Gh0st RAT so common?
The original source code for Gh0st RAT was released publicly many years ago, allowing a wide variety of threat actors to easily modify, customize, and deploy their own versions of the malware.
How do I remove the Gh0St Rat from Windows?
Manual removal of Gh0St is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Gh0St a virus or a Rat?
Gh0St is classified as a Rat. Unlike traditional viruses that infect files, modern malware like Gh0St typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Gh0St infection?
Symptoms of Gh0St can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: rat)
Explore other malware families in the same category:
Protect Your Network Against Rats
Want to prevent Gh0St and similar threats from compromising your organization? Read our comprehensive defensive guide: Backdoor & RAT Protection.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/gh0st.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.