Executive Summary
This analysis evaluated a malicious executable (sha256: ea7cd59c0105f693f6d4ba662f901bb509912a4b9ce9fb24cb03983f494abdfb) disguised as a legitimate Valorant game installer. Technical investigation revealed the payload to be a dropper for Gh0st RAT, a prominent Remote Access Trojan capable of stealthy persistence, credential harvesting, full system surveillance, and remote administrative control.
The threat poses a Critical risk to affected hosts due to its ability to capture system credentials, exfiltrate sensitive token data, execute unauthorized code under SYSTEM privileges, and evade standard detection mechanisms.
File Metadata
Initial Executable
Filename: vgc2pc.exe
Size: 16.45 MiB
Sha256: ea7cd59c0105f693f6d4ba662f901bb509912a4b9ce9fb24cb03983f494abdfb
Filetype: Win32 EXE
Packed: yes
Sections: 9
Packed Section: .O#J
Dropped File: 1
Filename: vgc_emu.exe
Size: 553.00 KiB
Sha256: e0bef429a3efe6be6a31af8246727d54b12c9a65d1066b85bef31ff029378bfd
FileType: Win64 EXE
Packed: No
File Modification: 2004:08:18 08:30:00+05:30
Dropped File: 2
Filename: svchost_worker.dll
Size: 181.53 KiB
Sha256: 2f4f3bce4e588901683edc36575b14e829d70007673a001e13ab9d7d18c6fa8f
FileType: Win32 DLL
Packed: No
PDB Filename: C:\Users\a\Desktop\ghostrat\Server\svchost\Release\svchost.pdb
Language Code: Chinese (Simplified)
Malware Family
Gh0st RAT (Remote Access Trojan) is a long-standing, open-source Remote Access Tool first developed in China around 2008. Because its original source code leaked to Chinese-language underground forums, it became a foundational framework for dozens of modified variants (such as Zegost, Miansha, BBSRAT, and PseudoManuscrypt).
Core Capabilities
- Remote Desktop & System Control: Allows threat actors to view live screens, track cursor movements, simulate keyboard/mouse input, or take remote shell control.
- Surveillance: Actively intercepts input via keylogging and captures audio/video feeds directly through connected webcams and microphones.
- File & Payload Delivery: Supports arbitrary file transfer (upload, download, delete) and can download and execute additional malware payloads on command.
- System Manipulation: Enables process discovery, process termination, clearing of System Service Descriptor Table (SSDT) hooks, and remote system reboot or shutdown.
Yara Rule
rule Gh0stRAT_Payload_SvchostWorker {
meta:
description = "Detects Gh0st RAT DLL payload via C2 strings, magic headers, and capability indicators"
author = "Threat Analysis"
date = "2026-09-24"
threat_type = "Remote Access Trojan / Payload"
strings:
$b64_c2 = "rqanvbGwva6nsr2xsKapp6+f" ascii
$c2_header = "Gh0stj" ascii
$entry_fn = "RundllEntry" ascii wide
$inject_fn = "Command_Create&Inject" ascii wide
$b_chrome = "Google" ascii wide
$b_edge = "Edge" ascii wide
$b_vivaldi = "Vivaldi" ascii wide
$api1 = "SeShutdownPrivilege" ascii
$api2 = "ExitWindowsEx" ascii
$api3 = "InterlockedExchange" ascii
condition:
uint16(0) == 0x5A4D and
(
$b64_c2 or
($c2_header and ($entry_fn or $inject_fn)) or
(all of ($api*) and 2 of ($b_*)) or
5 of ($*)
)
}
Dynamic Analysis Findings
Registry Modifications:
Added a Run key under SOFTWARE/Microsoft/Windows/CurrentVersion/Run and the command added is rundll32.exe svchost_worker.dll, RundllEntry Default.
Files Created, Modified or Deleted:
- Dropped vgc_emu.exe into C:\Windows\vgc_emu.exe
- Dropped the DLL payload svchost_worker.dll
- Copied svchost_worker.dll into the %TEMP% directory
- Created clones of svchost_worker.dll if it already existed on the system
Processes Spawned, Injected, or Terminated
- Executed vgc_emu.exe as the runner binary
- Spawned rundll32.exe to run svchost_worker.dll
- Executed schtasks.exe commands to create scheduled tasks
– schtasks.exe /create /f /tn “Microsoft\Windows\AppID\SecurityHealthService_boot” /tr “<payload_path>” /sc onstart /ru SYSTEM
– schtasks.exe /create /f /tn “Microsoft\Windows\AppID\SecurityHealthService” /tr “<payload_path>” /sc onlogon /rl highest
- Spawned multiple instances of the payload in memory
Network Based Indicators
Command-and-Control (C2) IP Addresses and Domain Names:
- IP Addresses: 192.23.185.239, 103.124.101.68 (located in Seoul, South Korea under SBKorea), and 198.23.185.239.
- Domain Names: Operators used dynamic DNS to mask C2 locations behind rapidly changing IP addresses (specific domain names were not specified in the text).
- Obfuscation & Encryption: C2 communications were compressed with Zlib and encrypted using RC4 and XOR algorithms. Encrypted destination IP strings were obfuscated using Base64 and custom byte manipulation.
Program used to Decrypt the C2 IP address
import base64
def decrypt_ip_builder(data: bytes) -> bytes:
return bytes(((b + 0x7A) & 0xFF) ^ 0x19 for b in data)
cipher_b64 = "rqanvbGwva6nsr2xsKapp6+f"
encrypted_bytes = base64.b64decode(cipher_b64)
decrypted_bytes = decrypt_ip_builder(encrypted_bytes)
decrypted_text = decrypted_bytes.decode("utf-8", errors="ignore")
print("Decrypted String:", decrypted_text)
Mitigation
Terminate all active malicious processes, specifically vgc_emu.exe, any rundll32.exe instances executing svchost_worker.dll. Immediately isolate affected hosts from local networks, VPNs, and the internet to halt active command-and-control communications and stop data exfiltration. Remediate host persistence by deleting the autorun key added under SOFTWARE/Microsoft/Windows/CurrentVersion/Run that executes rundll32.exe svchost_worker.dll, RundllEntry Default. Delete the created scheduled tasks named SecurityHealthService_boot and SecurityHealthService using schtasks.exe. Permanently purge all dropped files and payload clones from the system, including C:\Windows\vgc_emu.exe, %TEMP%\svchost_worker.dll, and the initial executable binary (sha256: ea7cd59c0105f693f6d4ba662f901bb509912a4b9ce9fb24cb03983f494abdfb) disguised as a game installer. Block all inbound and outbound perimeter network traffic targeting command-and-control IP addresses 103.124.101.68, 192.23.185.239, and 198.23.185.239 on port 80/HTTP.
