Researchers Find Customized Certificates on Gh0st and Pantegana RAT Infrastructure

Jun 12, 2024 · Original article ↗

Summary

Hunt IO identified Gh0st and Pantegana RAT infrastructure, including Pantegana-like certificates with altered fields that may evade scanners relying on default certificate details.

Key points

Pantegana is a cross-platform Golang RAT for Windows, Linux, and macOS, supporting command execution, file transfers, and system fingerprinting.
Gh0st C2 servers can return a “Gh0st” packet flag; the article notes this indicator can vary.
Hunt IO's scans found fewer than 10 servers for each RAT family, though code and infrastructure changes may limit detections.
Two servers used certificates resembling Pantegana's default certificate but with altered organization and state fields, potentially evading searches for exact defaults.
One observed server hosted a Cobalt Strike Team Server while controlling Pantegana agents.
The article lists suspected C2 IPs and certificate fingerprints; two customized-certificate servers were marked clean by VirusTotal, which the author cautions is not definitive.

Article Details

Attack Vectors: Cofense reported a phishing campaign disguised as an invoice that dropped Gh0st RAT and targeted a healthcare organization in mid-2023.
In June 2022, Volexity reported that DriftingCloud installed Pantegana and other open-source malware on a compromised server.
Defensive Notes: Gh0st RAT C2 servers may return a packet flag containing “Gh0st” in response to a probe, though the flag has variations and should be paired with other information.
Pantegana's default server certificate has a 10-year validity and includes the common name “localhost” and issuer common name “Pantegana Root CA.”
Do not rely only on default Pantegana certificate details for detection: the article reports suspicious certificates with modified organization and state fields.
The article cautions that VirusTotal clean scores should not be treated as a concrete measure of whether infrastructure is benign.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`img[.]zchyedu[.]com`	Described as a suspicious domain resolving to a Gh0st C2 server.
DOMAIN	`www[.]kuaidiyouhui[.]asia`	Domain associated in the article with Gh0st infrastructure.
DOMAIN	`www[.]zchyedu[.]com`	Described as a suspicious domain resolving to a Gh0st C2 server.
DOMAIN	`zchyedu[.]com`	Described as a suspicious domain resolving to a Gh0st C2 server.
IPV4	`114[.]25[.]86[.]191`	One of two additional servers reported to share a certificate with the Gh0st-related server at 125.228.229.229.
IPV4	`119[.]28[.]107[.]67`	One of two suspicious servers hosting a certificate similar to Pantegana's default certificate.
IPV4	`125[.]228[.]229[.]229`	Gh0st-related server hosting a self-signed certificate; included among the three servers sharing that certificate.
IPV4	`125[.]229[.]22[.]79`	One of two additional servers reported to share a certificate with the Gh0st-related server at 125.228.229.229.
IPV4	`154[.]12[.]93[.]14`	Gh0st C2 server hosting an X.509 certificate the article says is consistent with DcRAT servers.
IPV4	`154[.]92[.]19[.]225`	Reported as a Pantegana C2 server that also hosted a Cobalt Strike Team Server.
IPV4	`43[.]130[.]237[.]18`	One of two suspicious servers hosting a certificate similar to Pantegana's default certificate.
IPV4	`47[.]120[.]59[.]37`	Identified by the article's scanners as a Gh0st C2 server.
IPV4	`62[.]234[.]90[.]4`	Identified as a Gh0st C2 server hosting suspicious domains and a self-signed RDP certificate.
SHA256	`6cdb3b8125f0975bb1299d88eb650cf6ed12ca31f21a65d15758c957c7b9f18a`	AnyDesk certificate hash listed for a Gh0st C2 server.
SHA256	`81348a5f80957e3f584a216ecd636886bda2f89fbc4b0e5a0f6cdabe815cb5e6`	Private-IP certificate hash listed for a Gh0st C2 server.
SHA256	`d0a66fafcc28fe8c1aeecffcb56efc76196aac53cf64d438a172b5c0af2ea6b4`	RDP certificate hash listed for a Gh0st C2 server.