Executive Summary
On 14 October 2026, Group-IB researchers published an in-depth analysis of KGB RAT. KGB RAT is a Remote Access Trojan (RAT) for sale on the dark web under the pretense of a legitimate Remote Administration Tool targeting Windows platforms. KGB RAT operates with a MaaS (Malware as a Service) distribution model, and the malware’s crypter receives daily updates to maintain its FUD (Fully Undetectable) status against antivirus tools that rely on signature-based detection. The main features of the tool include keylogging, hidden desktop takeover, credential theft, and ransomware but also a set of psychological harassment features like forced blue screens of death, jump scares, and screamer functions.
Key Takeaways
Key discoveries provided by Group-IB include:
- The builder bundles credential theft, keylogging, Hidden Virtual Network Computing (HVNC), and ransomware in a single package, plus a set of psychological harassment features like screamers, jump scares, and forced blue screens, labeled by the developers as “fun settings.“ .
- Operators abuse legitimate infrastructure to stay low-profile, using the Telegram Bot API for C2 notifications and ip-api[.]com for victim geolocation, backed by a daily-updated FUD crypter designed to defeat Windows Defender.
- The sample cluster points to multiple distinct operators sharing a common builder, with at least one running an active CryptoClipper module for direct financial gain, while the tool’s authors remain publicly identifiable via nicknames and social media profiles.
Technical Details
Using Mandiant’s open-source tool CAPA , malicious capabilities in the malware binary can be discovered and mapped to a set of MITRE ATT&CK Tactics and Techniques.
Category |
Observed behavior |
Key ATT&CK techniques |
Collection |
Keylogging via application hook and polling; screen capture via WinAPI; clipboard monitoring and reading; collected data archived before exfiltration |
Keylogging (T1056.001), Screen Capture (T1113), Clipboard Data (T1115), Archive via Library (T1560.002) |
Discovery / Recon |
WMI queries; process enumeration; installed-software and AV product discovery; registry queries; hostname, user, OS-version, system-language and geolocation lookups |
System Info (T1082), Process (T1057), Software (T1518), Query Registry (T1012), System Owner/User (T1033), System Location (T1614/.001), Account (T1087), App Window (T1010), File & Directory (T1083) |
Defense Evasion |
VM detection (VMware, VirtualBox); analysis-tool and anti-decompiler checks; runtime deobfuscation; reflective code loading; registry modification; hidden windows; self-deletion via COMSPEC |
Sandbox Evasion (T1497.001), Obfuscated Files (T1027), Deobfuscate (T1140), Reflective Loading (T1620), Modify Registry (T1112), Hidden Window (T1564.003), File Deletion (T1070.004), Permissions Modification (T1222) |
Persistence |
Registry Run keys and Startup-folder entries; scheduled task (masquerading as “ChromeUpdate”); default file-association hijacking |
Run Keys / Startup Folder (T1547.001), Scheduled Task (T1053.005), Change Default File Association (T1546.001) |
Privilege Escalation |
Access-token manipulation; acquires debug and load-driver privileges (supports advertised UAC bypass) |
Access Token Manipulation (T1134) |
Execution |
Windows Management Instrumentation; process and thread creation |
WMI (T1047) |
Command & Control |
Acts as a TCP client and issues HTTP requests (dual-channel: direct socket C2 plus Telegram/ip-api over HTTP); sends/receives data including server-to-client file transfer |
– (mapped under MBC C2 Communication B0030.001/.002) |
Data Handling |
GZip compression; Base64 encode/decode; MD5 hashing; PRNG and regex use |
– |
Impact |
Clipboard modification – CryptoClipper wallet-address swapping |
Clipboard Modification (MBC E1510) |
Host / Process control |
Mutex creation; process and thread create/suspend/terminate; hide taskbar; power down monitor; read raw disk data; unmanaged memory manipulation |
– |
Mitigation Options:
Mitigation options provided by Group-IB include:
- Be skeptical of unexpected executables. KGB RAT relies on the victim manually running the initial dropper. Files received via email, messaging apps, or downloaded from unofficial sources should never be executed without verification.
- Monitor your scheduled tasks periodically. Review the task list for unfamiliar entries – particularly those with names mimicking legitimate software like “ChromeUpdate.
- Monitor and alert on scheduled task creation. schtasks /create commands executed with /sc ONLOGON and /rl HIGHEST flags by processes residing in AppData\Local\Temp should generate alerts by default.
- Enforce network egress filtering. Outbound connections from endpoint processes to api.telegram[.]org and ip-api[.]com outside of browser contexts should be flagged or blocked at the network perimeter.
IOCs:
Network IOCs
- Primary C2: 104[.]248[.]130[.]195 (ports 7489, 7490, 7492)
- Secondary C2: 2[.]59[.]134[.]215 (port 443)
- Geolocation service: ip-api[.]com/json/
- C2 notification: api[.]telegram[.]org/bot*/sendMessage
- Malware website: kgbrat[.]org
SHA-256 Hashes
- 559df774411724520865fa15aa8b7e209d0ee133db4dc3d3cd180e895d597a36
- 581c440644f93a17191b98158c467be5ae5972ab19668c6e8530a2034833bd45
- d4fc7867caf1349bbbfd1f2972fe92acedd8507ae89fa822c07f09a194127894
- d8fb0d64ea8b4a32d6c5869212a62a3c9c6357e4fd7e4cf090a67d22d8f78b62
- df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8
- 836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7
- 1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7
- d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2
- 22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4
- 25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646
- 8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e
- 3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e
- df792f965f693b0a2b5bffd9a1ea5127cbd4b13daa9ddb2559f54523604777d8
- 836ebabb6304dd873343e85eb51a9e8c9b3de8a68d5152c3ab0d496c8fc0fdf7
- 1b3c95cf2a030df15d1474af2ae96bfe9a6ed160319c1a8782237206035d82c7
- d691e9721c38104777664f8afd3941ededcadd433b3b593de3e21aa14d60f1f2
- 22255c3c488d4c92ea3567d1032e7a7c790a22cde989a8f0eb257c2d6d811ed4
- 25eb0dfbe57dc07d461e62643262c45de052b012529ad05c7f19c5eb0c1ed646
- 8c3e8d0a5fadbd696bcbd56313d69d94f41f1b2678cfea4db83999a6ad62a63e
-
3d71f8b5171f2fe47d9a247a193c1b48c1aaa4d533811e208b8d94ffa5800c9e
Host Artifacts
- %TEMP%\sys_config2.ps1
- %TEMP%\select.dat
- %TEMP%\sand.dat
- %TEMP%\scream.wav
- %TEMP%\obito.txt
- %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<RG value>
-
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\<RG value>.url
Runtime-Observed Registry Activity
- HKCU\Software\Classes\ms-settings\shell\open\command (Default + DelegateExecute)
- HKCU\Software\Classes\mscfile\shell\open\command
- HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Loader
- HKCU\Software\Clipper\BTC / ETH / TRC
- HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuerHidden = 0
- HKCU\Environment\SEE_MASK_NOZONECHECKS = 1
