The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar. Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory. It then passes the config buffer to the extracted DLL and calls the exported function (Shellex