At FireEye we monitor all kinds of attacks: targeted, non-targeted, and everything in between. We always try to figure out, not just how a piece of malicious code works, but also other possibilities, like whether it is related to some other malware, in what way, etc.

Gh0st has been much talked about and there is a lot of good research out there on this RAT (Remote Access Trojan). This RAT has been used in many serious attacks and a quick Google search on the Gh0st RAT will give you a lot of good articles which will go into great detail about the versions and the inner workings of the malware. However this post is not about Gh0st. Very recently while investigating some of these Gh0st infections, we identified another interesting piece of malware.