.: Gh0st RAT 3.6 :.

Released 13 years, 5 months ago. May 2008

By C.Rufus Security Team
Gh0st RAT 3.6

Additional Details

  • From: China
  • Coded by: C.Rufus Security Team
  • Version: Gh0st RAT 3.6
  • Released date: May 2008, 13 years, 5 months ago.
  • Family: Ghost
  • Category: Remote Access

MegaSecurity Notes

Server
Dropped File:
c:\WINDOWS\system32\6to4ex.dll
Size: 100,907 bytes 

Added to Registry:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_6TO4\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Enum
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\6to4\Security
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\HTTP\Parameters\.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\SharedAccess\Parameters\.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_6TO4\0000\Control
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Enum
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\6to4\Security





Tested on Windows XP
June 28, 2008

URL's and mails were automatically redacted (filtered) for reader's safety. However the filter is not perfect and can't find all harmful elements. If you find something dangerous including file link, website, mail address, profanity... contact me immediately at sub7crew@protonmail.com, thank you in advance.