GodRAT Reloaded: Legacy Code, Modern Tactics

GodRAT Malware Campaign Targets Financial Firms with Steganography and Legacy RAT Code

Evolution of Old Malware Families into Persistent Cyber Threats

The GodRAT malware campaign demonstrates how cybercriminals repurpose old malware like Gh0st RAT with advanced techniques such as steganography, modular payloads, and credential theft. First detected in September 2024 and still active as of August 2025, the attack specifically targeted financial institutions in Hong Kong, UAE, Lebanon, Malaysia, and Jordan, with malicious files disguised as financial documents and delivered via Skype messenger.

Attack Vectors and Infection Chain

From Disguised Files to Stealthy System Intrusion

The malware spread through .scr executables masquerading as financial files. Once executed, GodRAT loaders injected malicious shellcode into memory, either embedded directly or hidden inside image files using steganography. This technique helped bypass traditional detection systems. The malware then contacted its Command-and-Control (C2) servers to download additional payloads such as ONLINE.dll, granting attackers full control over compromised systems.

Modular Capabilities of GodRAT

File Management, Password Theft, and Persistence Mechanisms

GodRAT’s modular plugins enabled full system control:

• FileManager Plugin: allowed file listing, modification, deletion, and execution.

• Browser Credential Theft: deployed tools to extract and decrypt saved passwords from Google Chrome and Microsoft Edge, saving stolen data in “google.txt”.

• Persistence: achieved via registry entries tied to legitimate executables, ensuring stealthy relaunch.
  Additionally, AsyncRAT implants were observed, further extending attacker control and persistence.

Targets and Impact on Financial Sector

Why Financial Firms are High-Value Targets

The campaign primarily hit trading and brokerage firms in Asia and the Middle East. These institutions store vast amounts of sensitive financial records, client data, and transaction details, making them lucrative targets for credential theft, fraud, and long-term espionage. The continued use of legacy malware families with modern obfuscation techniques highlights the evolution of financial cyber threats.

MITRE ATT&CK Mapping

Techniques Exploited by GodRAT Campaign

GodRAT’s tactics align with multiple MITRE ATT&CK techniques:

• TA0001 Initial Access: Phishing & Spearphishing via services (T1566, T1566.003).

• TA0002 Execution: Command & Scripting Interpreter (T1059).

• TA0003 Persistence: Registry Run Keys / Startup Folder (T1547.001).

• TA0005 Defense Evasion: Obfuscation & Steganography (T1027, T1027.003).

• TA0006 Credential Access: Credentials from Web Browsers (T1555.003).

• TA0011 C2 Communication: Application Layer Protocols (T1071.001).
  This mapping underscores the sophistication and multi-stage nature of the attack.

Indicators of Compromise (IOCs)

MD5, SHA256, File Paths, Domains, and IPs

Notable IOCs from the campaign include:

• MD5 hashes: cf7100bbb5ceb587f04a1f42939e24ab, d09fd377d8566b9d7a5880649a0192b4

• SHA256 hashes: 18DADAC8E7591EF9BCC79B5417DF7751A3C08B204D98CEBF6FF4C54B3B5610C8

• Suspicious File Paths: %ALLUSERSPROFILE%\bugreport\360Safe2.exe, C:\Users\[username]\Downloads\2025TopDataTransaction&.scr

• C2 Infrastructure: 103[.]237[.]92[.]191, 118[.]99[.]3[.]33, wuwu6[.]cfd

• Malicious URL: hxxps[:]//holoohg[.]oss-cn-hongkong[.]aliyuncs[.]com/HG[.]txt

Security Recommendations

Proactive Defense Against Steganography-Based RAT Attacks

To defend against GodRAT and similar malware, organizations should:

• Avoid risky attachments: Do not open .scr or suspicious financial files shared via Skype or messaging apps.

• Strengthen account security: Use MFA and enforce strong passwords to block stolen credential abuse.

• Deploy NGAV & EDR: Leverage behavioral detection, machine learning, and memory scanning to spot RAT activity.

• Network monitoring: Track outbound traffic to unknown IPs and domains for signs of C2 beaconing.
  These measures significantly reduce the attack surface and limit exposure to evolving RAT campaigns.

References

• Kaspersky Securelist – GodRAT

• Hive Pro – Blind Eagle’s Banking Trap

• MITRE ATT&CK Tactics & Techniques