<\/p>\n\n\n\n
It’s not every day that you come across a DLL so new that even VirusTotal draws a blank. But it’s even rarer when this sample turns out to be a sophisticated RAT from China. <\/p>\n\n\n\n
But this is exactly what happened in our recent case. We discovered what may be a previously unseen version of the Gh0stBins RAT <\/strong>\u2014 an obscure malware family originating from the Middle Kingdom and sparsely studied in the field. Naturally, we had to analyze it. <\/p>\n\n\n\n The Chinese malware scene has recently undergone something of an industrial revolution, making modern Chinese malware a serious threat. In this article, we\u2019ll dive deep into this new Gh0stBins variant \u2014 and show you how to<\/strong> detect it with Suricata and YARA rules as well as recover leaked data using a Python script<\/strong>. <\/p>\n\n\n\n Let\u2019s get started. <\/p>\n\n\n\nHow we Discovered this Gh0stBins Sample <\/h2>\n\n\n\n