Signed Windows Utility Loader Delivers GodRAT Through Process Injection

Summary

Analysis finds a signed 62 MB Windows utility hiding a 9.7 KB loader that retrieves GodRAT over raw TCP and injects it into cmd.exe. The certificate also signed a separate Golden Gh0st loader, but attribution remains undetermined.

Key points

The 62 MB signed .NET bundle contains a 9.7 KB malicious component that decrypts shellcode and downloads a second-stage payload.
The stager requests the payload with GETGOD over unencrypted TCP to 103.145.191.136:443.
The downloaded GodRAT DLL has the same MD5 hash as a sample identified by Kaspersky in 2025.
GodRAT runs inside a hidden cmd.exe process using the -Puppet argument and reports host, user, Windows, IP, and antivirus details to its server.
The analyzed server sent no plugins during the sandbox run, so the operator’s intended activity and the RAT’s deployed functions were not observed.
The same EV certificate signed a separate Golden Gh0st RAT downloader, but differing protocols, servers, keys, and delivery methods leave the relationship between operators unresolved.
The article recommends blocking the reported IP, hunting for cmd.exe -Puppet and GETGOD traffic, and treating files with the certificate serial as malicious.

Article Details

Attack Vectors: The initial delivery method for the signed Windows Utility Suite is unknown.
The signed .NET bundle contains a small loader that XOR-obfuscates a password and uses it to AES-GCM-decrypt shellcode.
The shellcode opens a plain TCP connection to 103[.]145[.]191[.]136 on port 443, sends GETGOD, and downloads the next stage into memory.
The downloaded GodRAT payload is copied into a hidden cmd.exe process using the -Puppet argument.
GodRAT can receive and run plugins in memory, download and run files from URLs, and open web pages in Internet Explorer; no plugins were delivered during the observed sandbox run.
Defensive Notes: Block 103[.]145[.]191[.]136.
Hunt for cmd.exe launched with the -Puppet argument and TCP streams beginning with GETGOD\0.
Treat files signed with certificate serial 05923499141496b67bb7b4687809454b as malicious.
Investigate 62 MB .NET single-file applications whose own code is only a few kilobytes and calls VirtualAlloc and CreateThread.
Do not treat a valid code-signing signature or company name as evidence that a file is safe.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]145[.]191[.]136`	Stage-two download server and GodRAT command-and-control server, contacted over plain TCP on port 443.
MD5	`8008375eec7550d6d8e0eaf24389cf81`	MD5 hash of the GodRAT DLL; the article says it exactly matches the sample listed by Kaspersky.
SHA256	`2ce188196c078cc35ec6e8947821be57f5c061d4c06cf4bd4d329eac590576c8`	SHA-256 hash of the downloaded stage-two payload.
SHA256	`35c65263c0c90b8f15a86503e42ee16d7d6c786f4e54e75375a2794b73688f48`	SHA-256 hash of the decrypted stager shellcode.
SHA256	`36da0b939435ff7dcc43c28f16fa189e7f46893b98d1a09207470f2fb51e3433`	SHA-256 hash of the signed wsu.dll bundle identified as malicious.
SHA256	`3b9fb6ed76ddf3352202db134c5a28e85ea8b891db5b0633a1dc377495d56edc`	SHA-256 hash of the embedded .NET loader in the malicious bundle.
SHA256	`98b6951a39071cd8db154b045836347eb7ec916c774a856b83e01cff1a0780dd`	SHA-256 hash of the UPX-packed ONLINE.dll GodRAT payload.
SHA256	`f1cd4a32a8462f04fc1c1addcf2ce6afdfffaa840d8ded4c911b40cbd5d0b37a`	SHA-256 hash of the unpacked ONLINE.dll GodRAT payload.