GodRAT, a recently discovered remote access Trojan derived from the Gh0st RAT framework, has been actively targeting financial institutions since late 2024. The campaign leverages malicious .scr and .pif files delivered via Skype to initiate infections. By embedding shellcode within images through steganography, the malware ensures covert payload delivery and execution. Featuring modular plugins, credential theft capabilities, and AsyncRAT as a fallback implant, GodRAT shows strong associations with AwesomePuppet and the Winnti APT group, highlighting the continuous evolution of legacy malware families to support prolonged cyber-espionage operations.

Technical Description

Since late 2024, a sustained campaign has targeted financial organizations particularly trading and brokerage firms through malicious files disguised as legitimate financial documents. Distributed primarily via Skype, these .scr and .pif executables acted as delivery mechanisms for a new Remote Access Trojan (RAT) dubbed GodRAT, an evolved variant of the Gh0st RAT family. This campaign highlights how legacy malware frameworks continue to resurface with advanced capabilities to support modern cyber-espionage efforts.

‍

Delivery and Infection Chain:
Attackers leveraged steganography to conceal malicious shellcode within image files, enabling stealthy delivery and execution. Upon opening the infected file, the loader contacted remote Command-and-Control (C2) servers, fetched the GodRAT payload, and injected it into memory for execution.

Two primary loader types were observed:

1. Embedded Shellcode Loaders – with hardcoded XOR keys for decoding and in-memory injection.
2. Image-Based Loaders – extracting hidden shellcode from tampered files (e.g., SDL2.dll) paired with legitimate executables like Valve.exe signed with expired certificates to evade detection.

‍

Technical Capabilities:
GodRAT operates in a multi-stage architecture:

• Initial shellcode retrieves configuration data containing C2 IP, port, and parameters.
• The malware initiates communication by sending a GETGOD request, receives secondary payloads, and performs reflective DLL injection, often into curl.exe or cmd.exe for stealth.
• The RAT includes a rare -Puppet parameter, reinforcing its connection to the AwesomePuppet lineage.

Once active, GodRAT collects and exfiltrates extensive host and user information, including OS details, process IDs, antivirus presence, and user credentials, encoding the data multiple times before transmission.

‍

Modular Plugins and Secondary Payloads:
The malware is highly modular, with plugins extending its functionality:

• FileManager Plugin – Allows attackers to browse directories, move, delete, or execute files, and create directories both visibly and invisibly.
• Credential Theft Modules – Extract login credentials from Google Chrome and Microsoft Edge using browser databases and decryption keys.
• AsyncRAT Integration – Deployed as a backup implant, providing redundancy and disabling AMSI and ETW logging for improved persistence and defense evasion.

‍

Attribution and Evolution:
Analysis shows strong overlaps between GodRAT and AwesomePuppet, another Gh0st RAT-derived malware first reported in 2023. Both leverage similar delivery techniques and share code-level similarities. These indicators link GodRAT activity to the Winnti APT group, known for long-term espionage campaigns across multiple sectors.

‍

Active Campaign and Geographic Spread:

The campaign remains ongoing as of August 2025, with detections reported in Hong Kong, the UAE, Jordan, Lebanon, and Malaysia. Attackers commonly use file names mimicking financial records such as “2023-2024ClientList.scr” to lure victims into executing the payload

‍

Accessibility and Proliferation:

A critical factor in GodRAT’s spread is the public leak of its source code and builder on an online malware scanning service in mid-2024. This builder allows threat actors to customize payloads, choose injection processes, and generate malicious files in .exe, .scr, or .pif formats. This availability has fueled broader adoption among multiple threat groups, reinforcing how legacy malware toolkits continue to circulate and evolve within underground ecosystems.

‍

Conclusion:

GodRAT represents the ongoing evolution of legacy malware, combining the Gh0st RAT foundation with modern techniques like steganography, modular plugins, and backup implants to support stealthy and persistent attacks. Its public builder release has accelerated adoption among multiple threat actors, expanding its reach across regions and industries. The campaign’s active status and links to groups like Winnti APT highlight its role in long-term cyber-espionage operations. Organizations, particularly in the financial sector, should prioritize advanced detection, network segmentation, and regular threat hunting to mitigate such evolving threats.

‍

Impact

GodRAT poses a significant risk to financial institutions by enabling data theft, credential harvesting, and long-term unauthorized access to critical systems. Its modular architecture and stealth techniques allow attackers to expand capabilities, evade detection, and maintain persistence. The use of publicly available builders increases its adoption, amplifying the threat landscape. If left unaddressed, infections could lead to financial fraud, data breaches, and operational disruptions.

IOC and Context Details

Recommended Actions

• Maintain Systems and Certificates: Regularly patch operating systems, browsers, and third-party applications, and monitor for expired or unauthorized digital certificates.
• Enhance Email and Messaging Security: Implement robust filtering on corporate communication tools, including Skype, to block suspicious attachments like .scr and .pif files.
• Educate Employees on Social Engineering: Conduct ongoing training for staff, especially in finance, to identify phishing attempts and malicious documents.
• Strengthen Endpoint Defenses: Deploy advanced endpoint protection with behavioral analysis to detect unauthorized process injections and steganography-based loaders.
• Monitor Network Traffic: Actively watch outbound connections for unusual C2 communications or encoded data sent to suspicious IP addresses.
• Restrict Execution of Risky Files: Enforce group policies to prevent execution of high-risk file types and disguised executables.
• Implement Strong Credential Protection: Apply multi-factor authentication (MFA) and enforce secure password policies to reduce the impact of stolen credentials.
• Proactive Threat Hunting: Search for known GodRAT and AsyncRAT indicators, including malicious DLLs, persistence mechanisms, or abnormal process activity.

References

• https://thehackernews.com/2025/08/new-godrat-trojan-targets-trading-firms.html
• https://www.sentinelone.com/blog/the-curious-case-of-gh0st-malware/