Busting GodRat: Analyzing the Rat and Its Infrastructure

Cracking the GodRat Campaign: Unmasking Its Infrastructure & How to Block It

The GodRat Trojan is believed to be operated by the Chinese threat group Winnti (APT41), known for targeting financial institutions, including trading and brokerage firms. Using steganography to conceal malware in image files, GodRat is delivered via .SCR files disguised as financial documents on platforms like Skype. The malware, which is based on the Gh0st RAT and its derivative AwesomePuppet, is designed to steal sensitive information and deliver additional payloads. Winnti, active since at least 2024, has targeted regions such as Hong Kong, UAE, and Malaysia, likely driven by financial espionage motives.

The Anatomy of GodRat Malware

Upon analyzing the GodRat malware, we uncovered critical details about its structure, file behavior, and potential impacts. Here’s what we discovered:

Malware Name: GodRat
File Name: Encrypted.exe
Malware Hash (SHA256): 48d0d162bd408f32f8909d08b8e60a21b49db02380a13d366802d22d4250c4e7
VirusTotal Detection: 51 Malicious Detections
Malicious Imports: 66 detected imports, including:

getsockvalue
sendto
CryptDestroyKey
VirtualAlloc
WriteFile
GetEnvironmentVariableW
GetCurrentProcess
WSACleanup, etc.

Key File Analysis Findings

Our indepth analysis of the file using PEStudio revealed several characteristics that can help identify and defend against GodRat:

1. File Metadata

File Type: PE32 (Portable Executable)
Operating System: Windows Vista (I386, 32bit, GUI)
Linker: Microsoft Linker (14.36.35207)
Compiler: Microsoft Visual C/C++ (19.36.35207)
Language: C++
Tool Used: Visual Studio (2022, v17.6)
Sign Tool: Windows Authenticode (2.0) [PKCS 7]

The use of Visual Studio for compilation and Microsoft Authenticode for signing indicates that the malware was professionally developed, utilizing standard tools often used for legitimate software development.

2. Certificate Information

The certificate used to sign the malware was revoked by its issuer. The absence of a valid signature coupled with the revocation status is a clear sign that the malware may have been deliberately tampered with to bypass initial detection.

Certificate Status: Revoked by issuer

3. Binary Overlay

The presence of an overlay at offset 0x002f9e00 and size 0x32a8 is a technique commonly used to conceal parts of the malware, making it harder to analyze by traditional methods.

4. Malicious Imports

Among the 66 identified imports, the following function calls suggest the malware is trying to establish network communication, allocate memory, and manipulate files:

getsockvalue and sendto suggest network communication is a key part of the malware’s behavior, likely for data exfiltration or receiving commands from a remote server.
CryptDestroyKey and VirtualAlloc indicate that the malware is handling sensitive data and performing dynamic memory allocation.

5. Resource Information

Resource Language: Chinese-simplified (0x000000804)

Resource Version: 0x0804 (Chinese-simplified)

The use of Chinese-simplified as the resource language indicates that the malware may have originated from a Chinese-speaking region or targets organizations with ties to China. This could provide useful context when investigating the threat’s source and targets.

The Infrastructure Behind GodRat

The GodRat malware is typically part of a targeted attack campaign, involving a set of command and control (C2) infrastructure used to maintain persistence and exfiltrate data. Based on our investigation, we mapped out the following components and behaviors of the GodRat malware:

Malicious Network Communication:

Using tools like Wireshark and other traffic analysis utilities, we discovered that GodRat attempts to interact with a set of suspicious IP addresses and domains. These could be C2 servers used by the threat actors for remote control and data exfiltration.

For example, GodRat communicates with IP address 154.91.183.174, which has been flagged in multiple threat intelligence databases.

Malicious Domains:

Domain: wuwu6.cfd

This domain is linked to GodRat’s C2 infrastructure. Blocking access to this domain can prevent communication with the malware’s control servers, preventing further compromise.

Indicators of Compromise (IOCs)

Below are the key IOCs for GodRat that security teams should monitor and block to help mitigate the risks associated with this malware campaign.

These IOCs should be actively blocked in firewalls, intrusion detection systems (IDS), and endpoint protection tools to prevent GodRat infections from spreading.

The Attack’s Footprint and Remediation Strategy

GodRat uses multiple advanced techniques to evade detection, including the use of obfuscated overlays, revoked certificates, and networkbased exfiltration. Its ability to avoid initial detection, even in the presence of common antivirus solutions, makes it a formidable adversary.

To counter this threat, it’s essential to adopt a multilayered defense strategy, including:

1. Network Traffic Analysis: Monitor outgoing traffic for suspicious communication to known C2 servers or unusual ports.
2. Endpoint Detection and Response (EDR): Implement EDR tools capable of detecting malicious file behavior and unauthorized system changes.
3. Regular Vulnerability Scanning: Ensure that your systems are patched and do not have publicly known vulnerabilities (such as CVE202529824).
4. Threat Intelligence Feeds: Use real time threat intelligence to stay updated with the latest IOCs and TTPs (Tactics, Techniques, and Procedures).

Conclusion

The GodRat Malware campaign highlights a growing trend in advanced, targeted cyberattacks that use C2 infrastructure to maintain persistence and evade detection. By mapping out the malware’s infrastructure and identifying key IOCs, organizations can implement the right defenses to mitigate this threat.

Security teams should take proactive measures, blocking the identified IOCs and employing robust network monitoring and endpoint defense tools to stop the spread of this dangerous malware. Being aware of the attack infrastructure and implementing security best practices can greatly improve your organization’s resilience to GodRat and similar threats.

Stay vigilant cyber threats are evolving, and the time to strengthen your defenses is now.