Techniques for Analysis When I was analyzing this sample, the malware was unable to connect to its C2.  However, I was still able to analyze the network traffic of the sample.  How, you might ask?  Using a hex editor and a script I wrote to encrypt text using the algorithm that this sample uses, I encrypted my own C2 address (192.168.1.108:7721) and replaced the hardcoded C2 address with my own encrypted address.  I then opened a listener on my own IP on the respective port.    [Screenshot 3] comparison of My IP (Left) vs C2 IP (Right) Next, using a debugger, I set a couple breakpoints in the Internet Communications function and ran the malware.  The malware sample then connected to my IP and sent information to me, which I was able to observe using Wireshark.  After I’d captured the traffic, I was able to write another script to decrypt and decompress the traffic in order to view the data being sent.  Additionally, I then wrote a socket script that detects the Gh0stRAT variant traffic, automatically decrypts the traffic, and then extracts the Implant_Opcodes for the sample.  A second version of the script allows commands to be sent back to the malware, after I enumerated the exact command format for the sample.   [Screenshot 4] Output of Version 1 of the script So far, the 2 opcodes that the sample has sent are 0x65 and 0x66, or Implant_Heartbeat and Implant_Login, respectively.  “Hitting between the heartbeats” When sending commands, first the sample must login in with 0x65, then you can send commands to it.  However, you have to move fast as the sample will send an Implant_Heartbeat followed by an Implant_Login every 10 seconds or so, and if you try to send a command to the sample as it is responding with either opcode, it will ignore the command.  A proof of concept of the command script can be found here , while the Implant extraction script and the Command Script will be included in the Appendix