Signed Windows Security Health Service Impersonator Is a Gh0st RAT-Lineage Backdoor

Oct 16, 2026 · Original article ↗

Summary

Analysis found a backdoor impersonating Windows Security Health Service, signed with a valid certificate from an unrelated Chinese company. It profiled the infected PC, established persistence, and contacted a Hong Kong-geolocated server; its lineage is assessed with मध

Key points

The executable borrowed the name, description, and version information of a Windows component but was signed by Zhengzhou Xiaoye Network Co., Ltd., not Microsoft.
The backdoor contacted 103.82.53.214 on port 7661, with port 80 as a backup, and sent a profile including system, user, and security-product information.
Observed behavior included hiding the file, attempting to evade monitoring hooks and event tracing, and adding a SecurityHealth Run entry after the server accepted the machine.
The operator could run files, load plugins, clear Windows event logs, control power actions, schedule relaunches, and redirect the backdoor to a new server.
Code and traffic evidence point to the Gh0st RAT family, likely the Winos 4.0 / ValleyRAT branch; the author rates this assessment medium confidence, not confirmed.
The sandbox observed a login and heartbeats but no plugins, and the sample’s delivery method was unknown.
The article recommends checking the executable’s location and signer, removing persistence if found, and hunting for the listed network, mutex, registry, and certificate indicators.

Article Details

Attack Vectors: The delivery vector is unknown; the analyzed executable was provided on its own.
The backdoor connects to 103[.]82[.]53[.]214 on port 7661, with port 80 as a backup, and sends a profile of the infected PC.
After the server accepts the PC, the backdoor adds a SecurityHealth value to the current user's Run registry key for persistence.
The backdoor can receive and run files or modules, clear Windows event logs, create a scheduled task, and change its server settings. These capabilities were reported, but additional modules were not observed during the analysis.
The executable disguises itself with the name and description of Windows Security Health Service and hides its file from default folder views.
Defensive Notes: Block and hunt for 103[.]82[.]53[.]214 on ports 7661 and 80, and for HTTP requests using the user-agent IPQuery/1.0.
Alert on SecurityHealthService.exe running from outside System32 or signed by anyone other than Microsoft.
Hunt for the mutex Global\MyMainProcessMutex, the SecurityHealth Run value, and HKCU\Console\IpDate and HKCU\Console\IpDatespecial.
Check for scheduled tasks named WindowsUpdate_<number> and for wermgr.exe launched by an unusual parent process.
Block certificate serial 4369f1615ca645fdd9d03b6652aa55a3 and check for other files signed with it.
If the file has run, disconnect the device, remove the Run entry, check Task Scheduler, reveal hidden and protected operating system files to find and remove the executable, and change passwords from a clean device.

Indicators of compromise

Type	Indicator	Context
IPV4	`103[.]82[.]53[.]214`	Backdoor C2 server; the article reports port 7661 as primary and port 80 as backup.
MD5	`0890f44bbc61230652c6d3b0052ed5e9`	MD5 hash of the analyzed backdoor executable.
SHA1	`098608525d999524864a75e578e3a7425c0f6f74`	SHA-1 hash of the analyzed backdoor executable.
SHA256	`ca47e13a2980817e7849ddfef70312542ed11efaeba7b1b583161c06a440baf2`	SHA-256 hash of the analyzed backdoor executable.