KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize

Introduction

Group-IB researchers have identified and analyzed KGB RAT, a Windows-targeting Remote Access Trojan (RAT) that has been actively promoted across underground hacking forums since at least late-2025. Marketed under the guise of a legitimate Remote Administration Tool, KGB RAT is, in practice, a full-featured malware package that gives attackers silent and persistent control over infected Windows machines. What sets it apart from comparable RAT families is not only its technical breadth — combining credential theft, keylogging, hidden desktop takeover, and ransomware in a single builder — but also a dedicated set of psychological harassment features, including screamer functions, jump scares, and forced blue screens of death. These “fun settings”, as the developers themselves describe them, signal a threat actor profile comfortable weaponizing victim anxiety alongside data theft.

The tool is sold as a Malware-as-a-Service (MaaS) offering free and paid tiers, and is updated on a daily basis according to its developers. It ships with a built-in FUD (Fully UnDetectable) crypter designed to bypass Windows Defender and other antivirus products, requires no port forwarding for C2 connectivity, and delivers Telegram-based notifications when a new victim connects.

Group-IB researchers have found evidence of early KGB RAT server infrastructure (v0.1) dating to late January 2022, suggesting a development timeline that predates the public advertising campaign by several years.

This blog post contains analysis of:

• The origin and promotion history of KGB RAT across underground forums.
• The full feature set advertised by its developers, including HVNC, credential harvesting, payload generation, and harassment modules.
• Technical indicators of compromise (IoCs) and infrastructure observations.
• Recommendations for defenders and organizations seeking to detect and mitigate this threat.

Key discoveries

• KGB RAT is a commodity RAT sold as Malware-as-a-Service with free and paid tiers, and marketed deceptively as a legitimate “Remote Administration Tool.”
• The builder bundles credential theft, keylogging, HVNC, and ransomware in a single package, plus a set of psychological harassment features like screamers, jump scares, and forced blue screens, labeled by the developers as “fun settings”.
• Operators abuse legitimate infrastructure to stay low-profile, using the Telegram Bot API for C2 notifications and ip-api[.]com for victim geolocation, backed by a daily-updated FUD crypter designed to defeat Windows Defender.
• The sample cluster points to multiple distinct operators sharing a common builder, with at least one running an active CryptoClipper module for direct financial gain, while the tool’s authors remain publicly identifiable via nicknames and social media profiles.

Who may find this blog interesting:

• Threat Intelligence analysts and researchers
• Malware analysts and reverse engineers
• SOC analysts and incident responders
• Cybersecurity professionals in financial services and retail
• Law enforcement investigators

Group-IB Threat Intelligence Portal: KGB RAT

Group-IB customers can access our Threat Intelligence portal for more information about this malware.

Public Malware Detonations:

Access free detonation reports linked to KGB RAT and watch malware operate in real time through detailed insights from the Group-IB Malware Detonation Platform:

• Detonation report #1
• Detonation report #2
• Detonation report #3
  

Origins of KGB RAT

From forum post to active threat

KGB RAT first surfaced in publicly accessible cybersecurity reporting in September 2025, when an early breach alert flagged the tool as a newly observed threat. It subsequently gained wider attention across the security community in late 2025, with coverage appearing on multiple threat monitoring and cybersecurity news outlets (GBHackers, Cyber Press, Cryptika).

The tool was first observed to be promoted directly on hacking forums around late-2025; the advertising copy distributed across those forums made its intent unambiguous:

“It is the premium windows RAT that have built-in fud crypter and have so many powerful features. It is updated on daily basis and you can hack anyone windows easily by using this RAT.”

Threads promoting KGB RAT appeared on multiple underground forums and hacking communities, accompanied by screenshots demonstrating the builder interface and the tool’s evasion claims. Threat actors promoting the RAT emphasized two selling points above all others: its claimed ability to bypass and permanently disable Windows Defender and other antivirus solutions, and the absence of any port forwarding requirement, lowering the technical barrier for less experienced operators.

A longer development history than it appears

While the public promotion campaign began in late 2025, Group-IB researchers identified traces of earlier KGB RAT infrastructure. A public disclosure referencing a KGB RAT server at version 0.1 dates to late-January 2022, indicating the developer had been building and testing this tool for years before bringing it to market.

The MaaS model and daily update cadence

KGB RAT follows the MaaS distribution model that has become standard across the Windows RAT ecosystem – they use direct site and Telegram groups for offering this solution to their customers. The developer maintains a Telegram-based notification infrastructure for operators, issues daily updates to the crypter to maintain FUD status against updated antivirus signatures, and offers a builder that generates payloads in multiple formats (.exe, .bat, .hta, .reg). This update cadence is a deliberate operational choice: signature-based detection engines update their databases continuously, and a static RAT build has a short evasion window.

The addition of ransomware functionality as a bundled module is notable: it positions KGB RAT not merely as a surveillance tool but as a platform operators can use to pivot from initial access to extortion without deploying a separate payload.

The harassment and psychological distress features — screamer functions, forced blue screens, and what the developers label “fun settings” — are less common in RAT tooling at this capability level. Their inclusion suggests a developer community that spans both financially motivated cybercriminals and less sophisticated actors motivated by disruption or victim intimidation, and it broadens the potential operator base beyond organized fraud groups.

Figure 2. Screenshot of “Fun” settings nested under Extra menu option.

Advertised functionality

The website markets KGB RAT as an advanced Windows administration tool, leading with headline claims of complete Windows control, military-grade encryption, 100% Fully Undetectable (FUD) technology, advanced monitoring, Telegram alerts, and daily updates. Beneath that marketing veneer, however, the advertised feature set reads as a fairly complete surveillance and control toolkit.

Figure 3. KGB RAT key features.

For remote access, the tool promises full Remote Desktop Control with real-time screen sharing and mouse/keyboard input, alongside a Hidden VNC (HVNC) mode for invisible remote desktop sessions the victim never sees. It advertises live webcam and microphone capture, complete file management (upload, download, delete, and modify), keystroke logging with activity monitoring, and password recovery that harvests credentials from browsers, applications, and the system. System-level functionality includes registry editing, process and service management, UAC bypass and privilege escalation, persistence mechanisms, and rootkit capabilities, all wrapped in stealth features designed to minimize the malware’s footprint.

The offering also leans heavily on payload generation and distribution. The developers advertise a custom payload builder capable of producing files in multiple formats (EXE, BAT, REG, and HTA), a FUD binder to attach the payload to legitimate executables, and a Unique Stub Generator (USG) that creates a distinct, undetectable stub with every build. LAN spreading is offered for automated propagation and lateral movement, and multi-client management lets an operator control many infected machines at once. Rounding out the feature list are Telegram notifications that alert the operator the moment a victim connects, and a Crypto Clipper module that monitors the clipboard and silently swaps cryptocurrency wallet addresses to redirect payments to the attacker.

Pricing

The tool is sold through a subscription model, with prices starting at $150 for one month and reaching $800 for a one-year plan. Renewals are offered at a lower price. Even the cheapest package includes remote desktop access, file management, camera and microphone access, keylogging, password recovery, persistence, and anti-detection features.

More expensive plans add functionality intended to support larger-scale operations, including multi-client management, payload customization, additional evasion features, plugin support, and access to a wider server infrastructure. The operators also sell a separate $500 “Network Spreading” add-on, which they claim can automate lateral movement and propagation inside a compromised network.

The pricing gives an idea of how low the entry barrier can be. For $150, a buyer can already get access to a fairly broad set of capabilities without having to develop or maintain the malware themselves.

The professional facade: Customer reviews, user guides, and legal disclaimers

KGB RAT developers made huge efforts to position this software as a legitimate solution. In this sense, its website is designed with fake customer reviews, claims of being used by more than 10,000 IT professionals, and an education section with how-to videos. There’s even an entire legal section with disclaimers, warnings and notifications encouraging users to make a legit use of their software. Additionally, they included educational videos of how to install, configure, and use the software.

Figure 4. KGB RAT website sells the malware as a professional system administrator tool.

Figure 5. Warnings and disclaimers on the KGB RAT website.

Tool Analysis

Despite its outward appearance and advertising as a legitimate administration tool, KGB RAT is used for malicious purposes. Group-IB researchers have reverse engineered the samples. Here are the results:

High-level behavior

At a high level, the malware acts as a “client” that:

• Сonnects to a remote controller (C2)
• Receives commands
• Performs malicious actions on the victim machine
• Returns results / captured data back to the operator

A notable giveaway in the code is a string similar to “KGB RAT – Client Online Now”,  which strongly indicates RAT branding by the author.

The majority of samples Group-IB detected are x86 PE executables implemented in .NET, compiled with the Microsoft Linker (version 11.0), using VB.NET as the primary language.

Static analysis via Detect It Easy immediately identifies the sample as NjRAT (0.7D Lime Edition, obfuscated), a well-known commodity RAT (malpedia, MITRE) widely used by threat actors of varying sophistication. This is a clear indication that KGB RAT shares a lot of NjRAT’s (also known as Bladabindi or Lime-Worm) capabilities and, therefore, the signatures for NjRAT also match the KGB RAT family.

It is important to note that we identified three distinct categories of KGB. RAT samples:

1. Unobfuscated samples, which can be analyzed directly without additional preprocessing steps.
2. Obfuscated samples, which require additional de-obfuscation efforts prior to meaningful static analysis.
3. Encrypted droppers and loaders, which perform cryptographic operations at runtime to reconstruct and execute the final payload — which may fall into either of the above categories.

Unless otherwise noted, the behavioral analysis throughout this report refers to the malware in its unobfuscated form, as it represents the clearest view of the underlying functionality.

RAT Capabilities

Using CAPA, an open-source static analysis tool, the following capabilities are identified when analyzing the sample. These capabilities correspond to a set of MITRE ATT&CK Tactics and Techniques, along with some matching Malware Behavior Catalog’s (MBC) Objectives and Behaviors.

Detecting KGB RAT

Group-IB’s Malware Detonation Platform (MDP) successfully detects KGB RAT regardless of the initial sample being a dropper or obfuscated. MDP detonates suspicious files in a controlled, instrumented environment that captures the full behavioral chain of a sample from initial execution through payload deployment, C2 registration, and post-infection activity. Because MDP analyzes behavior rather than static signatures, the FUD crypter bundled with KGB RAT does not prevent detection: the malware’s actions on the system expose it regardless of how its code is packed or obfuscated. MDP is able to capture and dump in-memory processes and launch YARA rules to detect whenever the deobfuscation happens, therefore detecting the actual piece of malicious software.

Thanks to the YARA signatures and configuration extractors implemented by Group-IB analysts, MDP is able not only to successfully identify the malicious sample and perform attribution, but also to extract the configuration parameters from the samples themselves.

The following screenshots are different KGB RAT samples detected by MDP. All of them are successfully attributed and their configuration extracted.

Configuration extraction

Our researchers identified the following configuration parameters for this malware family:

Group-IB’s MDP platform is able to successfully identify and extract these parameters from the analyzed samples. The following screenshot is an example of the extracted configuration fields:

Figure 7. Examples of extracted configs from a KGB RAT sample.

Dynamic Analysis: Runtime Behaviors

We analyzed KGB RAT samples in Group-IB’s Malware Detonation Platform to observe their runtime behavior. The sections below describe the main capabilities identified during execution and compare them with findings from the static analysis and extracted configuration.

Process Tree Overview

Figure 8. KGB RAT sample process tree.

The process tree captured by our platform provides a unified view of the entire execution chain, allowing all behaviors described below to be correlated within a single, chronologically ordered hierarchy:

The tree begins with the original sample (559df774...a36.exe, PID 3648) that is marked as the analyzed file. It has only 16 associated events, as its sole purpose is to install and relaunch itself.

It immediately spawns svchost.exe (PID 3680) — the renamed persistent copy dropped into AppData\Local\Temp — which becomes the primary malicious process for the remainder of execution, marked as a created file with 7 behavioral events. From this process, two distinct child execution branches are observed:

The first branch is a cmd.exe process (PID 3960) whose full command line is visible in the tree and directly matches two described detections in a single chained command:

This confirms that the ShowSuperHidden registry modification (T1112) and the suspicious PowerShell Explorer refresh (T1059.001) are not independent operations but are executed as a single atomic command — first hiding files, then immediately refreshing Explorer to make the change take effect without leaving a visible window open.

The second branch is schtasks.exe (PID 3116), executing the ChromeUpdate scheduled task creation command (T1053.005) documented earlier, with a conhost.exe child confirming it was invoked via a console host context.

The platform flags four nodes as Suspicious — cmd.exe, powershell.exe, reg.exe, and schtasks.exe — all of which are native Windows binaries being abused as part of the malware’s post-installation routine, a textbook example of Living off the Land execution that the process tree makes immediately legible as a coherent attack chain.

Persistence via Scheduled Task

Figure 9. Persistence mechanism command line at runtime.

As anticipated during static analysis — where the configuration field Scheduled_Task_Name was found hardcoded as ChromeUpdate — our platform successfully captures the persistence mechanism at runtime. Several elements of this command are worth highlighting. The task is registered under the name ChromeUpdate, a deliberate impersonation of a legitimate Google Chrome update process designed to avoid raising suspicion during casual inspection of the scheduled tasks list. The trigger is set to ONLOGON, ensuring the malware executes automatically every time any user logs into the system. The /rl HIGHEST flag requests the task run at the highest available privilege level, and /f forces creation without prompting, suppressing any confirmation dialogs.

The executable being persisted — svchost.exe — is dropped into C:\Users\Brenton\AppData\Local\Temp\, which directly matches the Initial_Execution_Directory: TEMP and Persistence_Program_Name: svchost.exe values extracted from the sample’s configuration. This confirms that the behavior observed at runtime is fully consistent with what the static analysis of the embedded configuration predicted, validating the end-to-end analysis chain.

System reconnaissance via WMI

Figure 10. WMI queries at runtime.

Our platform captures the full set of WMI queries issued by the malware at runtime, which collectively form a structured reconnaissance routine executed early in the infection chain.These queries are issued programmatically from within the malware’s own process via the System.Management COM interface, generating no visible command line or child process — making them invisible to detection approaches that only monitor process creation events.

Each query serves a distinct operational purpose.

• SELECT * FROM AntiVirusProduct — enumerates all installed AV/EDR solutions on the victim machine. This allows the malware to tailor its evasion strategy or report back to the operator which security products need to be bypassed.
• SELECT * FROM Win32_OperatingSystem — retrieves OS version, build number, locale, and system directory. Used for victim profiling and to ensure compatibility of subsequent payloads.
• SELECT Product, Manufacturer, SerialNumber FROM Win32_BaseBoard — pulls the motherboard’s hardware identifiers. This is a common sandbox/VM detection technique, since virtual machines often expose generic or well-known manufacturer strings (e.g., “VBOX”, “VMware”) in these fields.
• SELECT __RelPath FROM Win32_Process — enumerates all currently running processes. Used to detect analysis tools (debuggers, sandboxes, AV processes) or to find suitable injection targets, consistent with the Injection_Process: svchost.exe value extracted from the sample’s configuration

Suspicious PowerShell Process Spawning

Figure 11. Suspicious PowerShell process spawn.

The malware spawns a suspicious PowerShell process, capturing and deobfuscating the command line at runtime.This command uses the Shell.Application COM object to enumerate all open Explorer windows and call Refresh() on each of them. In the context of this malware, this is consistent with a technique used to force Windows Explorer to reload its view, which is typically executed after the malware has modified the filesystem or registry — for instance, after dropping files into startup locations or altering folder visibility settings. Refreshing Explorer ensures these changes take effect visually without requiring a reboot, while also potentially hiding newly dropped files from the user if hidden file attributes have been set — which aligns with the ShowSuperHidden registry manipulation identified during static analysis.

Figure 12. Malware self-installation step.

The malware’s self-installation step also was captured, recording the process spawning chain that reveals the transition from the initial execution context to the installed persistent copyThis entry documents the moment the original sample spawns and relocates itself as svchost.exe into the Temp directory. This is the direct runtime manifestation of the Install_Delete_Run: true flag extracted from the sample’s configuration, which instructs the malware to copy itself to the persistence location and relaunch under the masqueraded filename before deleting the original.

Hidden File Stealth via Registry Modification 

Figure 13. Windows Registry tampering captured.

The malware tampers with the Windows Registry to suppress the display of hidden files in Explorer, capturing the operation in full detail.This registry write sets ShowSuperHidden to 0, which disables the display of protected operating system files and super-hidden items in Windows Explorer.

The modification is performed through a spawned reg.exe process rather than directly via registry API calls, which is a common technique to blend the operation among legitimate administrative activity. The target registry key is written under the specific user SID (S-1-5-21-...1002), meaning the change is scoped to the active user’s profile — consistent with the malware executing in user context rather than as a system-level process.

Security Warning Suppression via Registry Modification

Figure 14. Security warning suppression.

Another registry manipulation is observed to be performed directly by the installed svchost.exe process, this time targeting Windows’ security zone checking mechanism.Setting SEE_MASK_NOZONECHECKS to 1 instructs Windows to bypass the Attachment Execution Service (AES) zone checks when launching executables.

Notably, this registry write is performed by C:\Users\Brenton\AppData\Local\Temp\svchost.exe at PID 3680 — the already-installed persistent copy of the malware identified in the previous section — rather than the original dropper. This indicates the suppression of security warnings is part of the malware’s post-installation routine, likely in preparation for fetching and executing additional payloads without alerting the victim.

Anti-Sandbox Sleep Delays 

Figure 15. Deliberate sandbox evasion techniques.

Two distinct sleep behaviors are exhibited by the installed svchost.exe process (PID 3680), both consistent with deliberate sandbox evasion.These two patterns serve different but complementary purposes. The 600-second sleep on thread 3760 is a classic sandbox evasion technique — most automated analysis sandboxes operate under strict time budgets (typically between 60 and 300 seconds) and will terminate analysis before the sleep completes, causing the malicious payload to never execute within the monitored window. This is particularly noteworthy given that the sample’s configuration had Sleep_Time: false, suggesting this delay may be hardcoded into the malware’s execution logic independently of the builder’s configuration options, or that the field governs a different sleep mechanism entirely.

The 4-second sleep called 4,412 times on thread 4020 tells a different story. Rather than a one-time evasion delay, this represents a polling loop — the malware repeatedly sleeping for short intervals between operational cycles. This is consistent with a C2 beacon loop, where the RAT periodically checks in with the command-and-control server, waits for instructions, executes them, and then sleeps before the next cycle. At 4 seconds per iteration and 4,412 recorded calls, this thread was actively beaconing for approximately 4.9 hours during the analysis window.

Keylogging via GetAsyncKeyState 

Figure 16. Keylogging activity captured at API call level.

We intercepted the malware’s keylogging activity at the API call level, capturing individual invocations of GetAsyncKeyState originating from the installed svchost.exe process (PID 3680) on thread 4020 — the same thread identified in the previous section as the primary operational loop.Several aspects of this detection are worth highlighting. The calls originate from an untrusted memory region (ioc.untrusted.base: 0x00007FFC4A760000), meaning the code issuing these API calls does not reside in a legitimately loaded and signed module — consistent with injected or dynamically allocated code executing within the process, which aligns with the process injection capability identified during static analysis.

The sequential polling of virtual key codes (vKey 48, 49, and continuing across many captured events) is the hallmark of a polling-based keylogger — rather than installing a system-wide hook via SetWindowsHookEx, this implementation iterates through virtual key codes and calls GetAsyncKeyState on each to determine whether that key is currently pressed. This approach is notably stealthier than hook-based keylogging, as it does not require registering a system hook that security products actively monitor.

The timestamp on the captured events (2026-05-06 12:57:08 UTC) places this activity well into the post-installation beaconing phase, confirming that keylogging runs concurrently with the C2 communication loop on the same thread — and that KeyLogging_Disabled: false in the extracted configuration is accurately reflected in runtime behavior.

C2 Beacon with System Fingerprint 

Figure 17. Initial beacon transmission to C2.

We intercepted the malware’s initial beacon transmission to the C2 server, capturing the full plaintext payload sent over the network. Applying the |Ghost| command delimiter identified in the extracted configuration, the beacon decodes into the following structured fields:

This single beacon transmission encapsulates the entire victim profile assembled by the WMI reconnaissance queries captured earlier — OS version from Win32_OperatingSystem, security product enumeration from AntiVirusProduct — and delivers it to the operator in one structured, delimiter-separated message. The correlation is exact: what the WMI queries collected, this beacon transmits.

The OS field reporting Win 10 Enterprise NSP0 x86 alongside No for administrator status indicates the malware is running without elevated privileges on this particular victim — consistent with Elevate_and_Bypass_UAC: false in the configuration. The three consecutive Windows Defender entries likely correspond to separate AV-related WMI fields (display name, path, and state), all resolving to the same installed product.

Credential Harvesting from Windows Credential Manager 

Figure 18. Malware observed accessing Windows Credential Manager vault.

The malware actively enumerating and accessing the Windows Credential Manager vault, recording filesystem-level access to the following paths.The Windows Credential Manager Vault stores encrypted credentials for websites, network resources, and Windows applications — including saved browser passwords, Remote Desktop credentials, and Microsoft account tokens. The traversal pattern captured here is systematic and deliberate: the malware first enumerates the root Vault directory, then descends into the specific vault identified by its GUID (4BF4C442-9B8A-41A0-B380-DD4A704DDB28), and accesses its Policy.vpol file — which contains the encryption policy and master key material required to decrypt the stored credentials. It then proceeds to the UserProfileRoaming directory and reads Latest.dat, which holds the roaming credential entries synchronized across sessions.

Victim Geolocation via External IP Lookup 

Group-IB also observed an outbound HTTP request to an external geolocation service ip-api.com, recorded both as a network-level HTTP request and as a domain resolution event:

The HTTP 200 response code confirms the request completed successfully, meaning the malware successfully retrieved geolocation data for the victim’s public IP address. This is the direct runtime confirmation of the http://ip-api.com/json/?GET string identified during static analysis and directly correlates with the Send_Victim_IP_to_Telegram: true configuration flag — the geolocation data retrieved here is what gets forwarded to the operator’s Telegram bot alongside the system fingerprint captured in the C2 beacon described earlier.

The ip-api.com/json/ endpoint returns a structured JSON response containing the public IP address, country, region, city, ISP, and approximate coordinates of the requesting host. This gives the operator an immediate geographic and network context for each new victim without requiring any additional tooling — a lightweight but highly informative reconnaissance step that costs the malware a single HTTP GET request.

Telegram Bot API as C2 Exfiltration Channel 

An outbound communication to api.telegram.org has been observed, confirming the use of the Telegram Bot API as a secondary exfiltration and notification channel — consistent with the Telegram_Bot_Token and Telegram_Chat_ID values extracted from the sample’s configuration, and the Send_Victim_IP_to_Telegram: true flag observed across multiple analyzed samples.

In the context of KGB RAT, the Telegram channel serves a specific and limited role: it delivers an immediate notification to the operator upon successful infection, containing the victim’s public IP address and geolocation data retrieved from ip-api.com in the previous step. The combination of a dedicated C2 server for command execution and Telegram for victim notification represents a two-channel architecture that separates operational control from alerting, making the overall infrastructure more resilient and harder to fully disrupt through blocking a single endpoint.

Environmental and Privilege Checks (T1134, T1497)

Figure 19. Malware environment and privilege checks.

Under privilege discovery (T1134), the malware calls AdjustTokenPrivileges and opens access tokens associated with both threads and processes — standard steps for privilege enumeration and potential escalation within the current execution context.

On the sandbox evasion front (T1497), three additional checks are recorded alongside the sleep-based evasion described earlier: enumeration of network interface card (NIC) addresses, querying installed printers, and reading USB device information from the registry. These are all classic virtual machine and sandbox detection heuristics — sandboxes typically expose generic or absent NIC configurations, have no printers installed, and show no USB device history, making their absence a reliable signal that the malware is executing in an analysis environment.

Finally, the platform flags mouse click monitoring via GetAsyncKeyState (T1497.002) as a human activity detection check — a sandbox that generates no mouse input is another strong indicator of an automated analysis environment, and the malware uses the same API already employed for keylogging to perform this check at no additional cost.

Process Hollowing Preparation — Suspended Process Creation

Figure 20. Suspended process creation.

The original dropper (PID 3648) creates its successor svchost.exe (PID 3680) in a suspended state, as evidenced by the recorded dwCreationFlags value of 0x04080414.Creating a process in a suspended state is a prerequisite for process hollowing and other injection techniques — the target process is instantiated but not yet executing, giving the parent process an opportunity to manipulate its memory space before resuming it.

Self-copying

Figure 21. Self-copying behaviour for persistence.

Group-IB observes the malware copying itself to its persistence location.This corroborates the Install_Delete_Run: true configuration flag and the process spawning chain described in the process tree section, closing the loop between the dropper’s execution and the installation of the persistent copy.

Additional analysis

So far, we have examined how MDP analyzes and detects KGB RAT, including the functionality embedded in the malware. To build a more complete picture, we examined several versions of the trojan identified during our research, compared their implementations, and took a closer look at some of its additional capabilities.

Brief analysis of extracted configuration files

We extracted the configuration files of all the analyzed KGB RAT samples detected in our MDP platform. Here’s a brief comparison of all of them:

Shared across ALL samples (hardcoded constants):

• Keylogging always enabled
• Scheduled task named ChromeUpdate
• UAC bypass disabled
• Injection into svchost.exe
• Bypass process: MoUsoCoreWorker.exe
• Process to kill: Wireshark.exe (but Kill_Process is always false, so this is never triggered)
• Persistence via Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
• Command delimiter: |Ghost|
• Developer message: WhyYouReverseMe..ImInnocent..LoveYouu..
• Fake error message body (the “files missing or corrupted” lure)
• Boolean configuration parameters: Install_Delete_Run: true, Send_Victim_IP_to_Telegram: true

What actually differs between samples:

1. C2 Infrastructure

The vast majority of samples point to 104[.]248[.]130[.]195, suggesting a single threat actor infrastructure. There’s only one sample using a different C2 (2[.]59[.]134[.]215) on port 443 — notably blending in with HTTPS traffic.

2. Telegram Bot credentials
Only three samples have populated Telegram fields:

• Two samples share the same bot token
  (8358126682:AAH...) but use
  different chat IDs — suggesting the same bot routing victims to different operator inboxes.
• One sample uses a completely different bot
  (5507005225:AAE...), indicating a separate operator or campaign.
• All remaining samples have empty Telegram fields — likely obfuscated or loader-stage samples where the token is embedded differently.

3. Victim separator (Base64)
This field is used to tag and identify victims in C2 communications:

• VmljdGlt → decodes to
  Victim
• S2luZw== → decodes to
  King
• S0lORw== → decodes to
  KING

The variation between King and
KING across samples is minor but suggests the builder was run multiple times with slightly different inputs.

4. CryptoClipper
Only one sample has the CryptoClipper module enabled, with three hardcoded wallet addresses for BTC, ETH, and TRC-20 (Tron).
This makes it the most financially motivated sample in the set and likely targets a different victim profile.

5. Initial execution directory
Most samples drop to TEMP.
Two samples use AllUsersProfile instead,
which requires broader system access and may indicate they are intended for multi-user environments or higher-privilege targets.

6. Kill_Other_Malware
Only one sample has this flag set to
true, suggesting this particular operator wanted to eliminate competing malware on the victim machine — a common behavior in cybercriminal ecosystems where operators protect their access.

is particular operator wanted to eliminate competing malware on the victim machine — a common behavior in cybercriminal ecosystems where operators protect their access.

More Functions Inside

Optional “dynamic C2” via Pastebin (depending on subscription)

If a flag such as “PasteE” is enabled, it can download a string (via WebClient().DownloadString) from a paste URL and decode it using character substitutions (a simple obfuscation layer). This can be used to update the C2 address/port without rebuilding the malware.

Figure 22. Dynamic C2 via Pastebin.

Screen capture

A “CAP” command:

• captures the screen via CopyFromScreen,
• draws the cursor on top,
• resizes to requested dimensions,
• sends as JPEG,
• prevents duplicates using an MD5 of the last capture.

Figure 23. Code snippet of screen capture capability.

Uninstall / self-delete (cleanup)

The uninstall routine (UNS() style) typically:

• deletes temp artifacts (e.g., sand.dat, select.dat, scream.wav)
• removes scheduled task ChromeUpdate
• removes Run key persistence values (including Policies Explorer Run “Loader”)
• removes registry keys used by UAC bypass techniques
• deletes its own config keys (e.g., under HKCU\Software\<RG>)
• triggers delayed self-delete via cmd.exe (common pattern: ping/sleep then del)

Figure 24. Code snippet of uninstall routine.

Evasion (anti-analysis) capabilities

Motherboard checking

One of the samples is packed with some anti-evasion functionality. For example, querying the motherboard model and checking against a pre-defined set of strings. If the motherboard turns out to be one of those, abort the execution. The analyzed sample checks for the following MB identifiers:

• VGNZPL985D
• Test
• Sandbox
• Temp
• Debug
• Default
• Trial
• Virtual Machine/VM
• Hyper
• D1120
• 700-210xt

Figure 25. Code snippet of malware checking certain motherboard strings.

Process monitoring (MyAntiProcess)
The sample includes a class named “MyAntiProcess” that actively checks running processes in an attempt to abort execution once one or more pre-defined processes are found. The set of checked processes are:

Figure 26. Code snippet of MyAntiProcess.

Execution Guard
The sample uses a marker file (also known as a sentinel file) named obito.txt located in the temporary directory to track its infection state. On its first execution, the malware displays a configurable decoy message box (e.g., a fake system error) to deceive the user. Subsequent executions detect the presence of the obito.txt file and bypass the message display, allowing the malware to remain stealthy during future operations. This technique is not only a simple re-execution detection mechanism, but also a social engineering trick that deceives users into thinking something went wrong with the execution.

Figure 27. Code snippet of execution guard technique.

Figure 28. The involved variables are within the identified configuration parameters.

User Account Control (UAC) Bypass
The code attempts a “fileless” UAC bypass using a known vulnerability involving the ms-settings registry path. It checks for the existence of Software\Classes\ms-settings\shell\open\command. This specific registry key is used by Windows high-integrity processes. By hijacking this key and calling OK.ElevateMe(), the malware can trick the system into executing it with Administrative privileges without ever triggering a UAC prompt. Counterintuitively, this code block is only executed if the ANYRUN flag is true.

Figure 29. Code snippet for fileless UAC bypass.

The ElevateMe() function implements a fileless UAC Bypass via Fodhelper/ComputerDefaults Registry Hijacking. By hijacking the ms-settings registry association and populating the DelegateExecute value, the sample forces the high-integrity ComputerDefaults.exe process to execute the malware payload. This allows the malware to escalate from a standard user to Administrative privileges without displaying a User Account Control (UAC) prompt to the victim.

Figure 30. Code snippet for ElevateMe() function.

CreateKey() is a thin wrapper around the Windows Registry API. It opens or creates the HKCU\Software\Classes\ms-settings\shell\open\command key, writes a single named value with the provided data, then closes the handle. The hardcoded key path is what ties it specifically to the ms-settings UAC bypass technique rather than being a general-purpose registry utility.

Figure 31. Code snippet for CreateKey() function.

After CreateKey() executes twice, the registry looks like this:

Both values are written to the same key, each via a separate call to CreateKey().

Process Protection
The sample implements a self-protection mechanism by marking itself as a “Critical Process.” Using the ProcessBreakOnTermination flag (29), any attempt to terminate the malware process will result in an immediate system crash (Blue Screen of Death). This is used to evade manual termination by users and to complicate the analysis process in virtualized environments.

Visual Camouflage via .url Files
The sample attempts to visually deceive the user when it creates malicious files. More specifically:

• Hidden Startup Shortcut: When creating a startup .url file (an Internet Shortcut file that points to the malware executable via URL=file:///path/to/malware.exe ), it sets the IconFile to SHELL32.dll and IconIndex=17 (usually a folder or generic icon) to blend in with legitimate system shortcuts.
• Process Migration: The flag11 block checks if the malware is running from its intended directory. If not, it copies itself there, starts the new process, and terminates the old one.

Figure 33. Code snippet of visual camouflage technique.

Competition elimination
The sample includes a class dedicated to competition cleanup. It functions by identifying, terminating, and deleting rival malware, automated scripts, and monitoring tools. This ensures that the primary payload (e.g., a crypto-miner or info-stealer) has maximum access to system resources and remains undisturbed by other infections.

Core Mechanisms

• Process Elimination: Immediately terminates scripting environments (cmd, wscript) and uses low-level APIs to forcefully kill every thread of a rival process.
• Heuristic Detection: Scans all running processes and flags them as “rivals” if they are unsigned, marked as Hidden/System, or located in user-writable directories (like AppData).
• File Destruction: Hijacks file permissions (ACLs), overwrites the rival’s contents to make them unrecoverable, and moves them to the Temp folder.
• Persistence Purge: Scans the Windows Registry (Run and RunOnce keys) and the Startup folder to delete any entry that allows a rival program to restart after a reboot.

Figure 35. IsFileMalicious code sample.

The IsFileMalicious method acts as the “decision engine” for the BotKiller. It evaluates every running process on the system to determine if it is a rival threat that should be terminated and deleted. It uses a mix of whitelisting (to stay under the radar) and heuristic blacklisting (to find other bots).

Key Decision Logic

1. Digital Signature Check: If a file is not signed (verified via WinTrust), it is much more likely to be flagged as malicious.
2. File Attributes: It checks if a file has the Hidden or System attribute. Legitimate user applications in the USERPROFILE folder are rarely marked this way, so the bot assumes they are rival malware trying to hide.
3. The “Kill” Decision: If the path is not whitelisted AND (it contains a blacklisted string OR is an unsigned hidden file in a user folder), the method returns true, triggering the DestroyFile routine

Conclusion

KGB RAT illustrates how established malware remains operationally relevant through accessible packaging and continued maintenance. Its public NjRAT foundation, configurable builder, documentation, and advertised crypter updates allow operators to deploy and modify the tool without developing or fully understanding its underlying capabilities. The analyzed cluster shows the practical result: multiple operators using a common builder, with at least one enabling CryptoClipper functionality to pursue financial gain.

This distribution model also shapes how the threat must be investigated. Shared code and infrastructure can connect samples without establishing that they belong to the same operator. Comparing configurations, enabled modules, and runtime behavior provides the additional context needed to understand how individual deployments differ. In this investigation, MDP’s behavioral analysis supported that work by exposing execution details concealed by obfuscation and reconstructing the processes involved.

The broader concern is the availability of a maintained attack tool that transfers much of the development burden from the operator to the supplier. Each customer can put familiar capabilities into use against a different set of victims, extending the reach of an otherwise unremarkable malware family. For defenders, this makes the behavior and deployment context of commodity malware as consequential as its technical design. A tool does not need a new technique to cause a new compromise.

Recommendations

For End Users

• Be skeptical of unexpected executables. KGB RAT relies on the victim manually running the initial dropper. Files received via email, messaging apps, or downloaded from unofficial sources should never be executed without verification.
• Pay attention to UAC prompts. An unexpected privilege escalation prompt triggered by a recently opened file is a strong warning sign that should not be dismissed.
• Do not ignore fake error messages. The malware displays a convincing system error dialog immediately after execution to distract the victim from the installation process. Legitimate Windows errors do not originate from files the user has just opened.
• Monitor your scheduled tasks periodically. Review the task list for unfamiliar entries — particularly those with names mimicking legitimate software like “ChromeUpdate.
• Keep your antivirus active and updated. The malware explicitly enumerates installed security products and attempts to add exclusions to Windows Defender. A fully updated endpoint security solution significantly raises the cost of a successful infection.

For Organizations

• Implement application whitelisting. The entire infection chain relies on execution of an unsigned, untrusted binary. Whitelisting policies restricting execution to approved, signed software neutralize the threat before any malicious behavior begins.
• Deploy behavioral endpoint detection. KGB RAT’s obfuscated variants evade static signature detection. EDR solutions capable of monitoring process creation chains, registry modifications, WMI queries, and API call patterns at runtime are essential.
• Monitor and alert on scheduled task creation. schtasks /create commands executed with /sc ONLOGON and /rl HIGHEST flags by processes residing in AppData\Local\Temp should generate alerts by default.
• Enforce network egress filtering. Outbound connections from endpoint processes to api.telegram[.]org and ip-api[.]com outside of browser contexts should be flagged or blocked at the network perimeter.
• Block the identified C2 infrastructure. The IP address 104[.]248[.]130[.]195 and secondary C2 2[.]59[.]134[.]215 should be added to network blocklists immediately. The Telegram bot tokens extracted from sample configurations should be reported to Telegram’s abuse team for deactivation.
• Detonate suspicious files before they reach endpoints. KGB RAT’s daily-updated FUD crypter defeats signature scanning, but its runtime behavior is unchanged. A detonation sandbox such as Group-IB’s Malware Detonation Platform (MDP) reconstructs the full behavioral chain and detects the malware whether it arrives as a clean binary, an obfuscated variant, or an encrypted dropper — extracting its configuration for attribution.
• Operationalize threat intelligence. Given the daily update cadence, the indicators here have a short shelf life. Continuous threat intelligence, such as Group-IB’s Threat Intelligence, keeps defenders current on evolving C2 infrastructure, bot tokens, and host artifacts, feeding them into blocklists and detection rules before they surface in the environment.

MITRE ATT&CK

Indicators of Compromise (IoCs)

Network IoCs

• Primary C2: 104[.]248[.]130[.]195 (ports 7489, 7490, 7492)
• Secondary C2: 2[.]59[.]134[.]215 (port 443)
• Geolocation service: ip-api[.]com/json/
• C2 notification: api[.]telegram[.]org/bot*/sendMessage
• Malware website: kgbrat[.]org

Protocol Markers

• Command delimiter: “|Ghost|”
• Scheduled task name: “ChromeUpdate”
• Masquerade process name: “svchost.exe” (dropped to %TEMP%)

File Hashes (SHA-256)

• 559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36
• 581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45
• d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894
• d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62
• df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8
• 836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7
• 1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7
• d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2
• 22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4
• 25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646
• 8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e
• 3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e
• df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8
• 836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7
• 1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7
• d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2
• 22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4
• 25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646
• 8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e
• 3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e

Host Artifacts

• %TEMP%\sys_config2.ps1
• %TEMP%\select.dat
• %TEMP%\sand.dat
• %TEMP%\scream.wav
• %TEMP%\obito.txt
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<RG value>
• %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<RG value>.url

Runtime-Observed Registry Activity

• HKCU\Software\Classes\ms-settings\shell\open\command (Default + DelegateExecute)
• HKCU\Software\Classes\mscfile\shell\open\command
• HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Loader
• HKCU\Software\Clipper\BTC / ETH / TRC
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = 0
• HKCU\Environment\SEE_MASK_NOZONECHECKS = 1

DISCLAIMER: All technical information, including malware analysis, indicators of compromise and infrastructure details provided in this publication, is shared solely for defensive cybersecurity and research purposes. Group-IB does not endorse or permit any unauthorized or offensive use of the information contained herein. The data and conclusions represent Group-IB’s analytical assessment based on available evidence and are intended to help organizations detect, prevent, and respond to cyber threats.
Group-IB expressly disclaims liability for any misuse of the information provided. Organizations and readers are encouraged to apply this intelligence responsibly and in compliance with all applicable laws and regulations.
This blog may reference legitimate third-party services such as Telegram and others, solely to illustrate cases where threat actors have abused or misused these platforms.

This material is provided for informational purposes, prepared by Group-IB as part of its own analytical investigation, and reflects recently identified threat activity.

All trademarks referenced herein are the property of their respective owners and are used solely for informational purposes, without any implication of affiliation or sponsorship.