Hunting Malware: An Example Using Gh0st

A Remote Access Trojan (RAT) is a form of malware which once installed on the victim's machine, passes command and control (C2) back to the attacker. RATs can be used to steal sensitive information, spy on victims, and remotely control infected hosts. RATs are increasingly difficult to detect because they behave in ways that many firewalls and other cybersecurity tools do not perceive as malicious. In this research, we demonstrate how a RAT can be identified by searching for evidence left behind after the attack. Our approach is based on the Locard principle, which essentially states that when an intruder comes into contact with an environment, the intruder leaves some form of forensic evidence behind. Inspired by this principle we started the hunt for a specific virus, Gh0st RAT. We know that the RAT has to contact the command and control, so we looked for evidence in the network traffic, by using the Wireshark software. Viruses can hide, but they still have to run, so we performed forensic analysis of the memory using the Volatility software to locate any evidence of the RAT. We also searched for evidence of the RAT on the hard drive. We are pleased to report that we were able to find traces of Gh0st in both the network traffic, running in memory and on the hard drive.