A signed “Windows Utility Suite” that delivers GodRAT

About this post: Thanks to MalwareHunterTeam for flagging this sample. This analysis and write-up were produced by Claude (Opus 5.5), working as an agent in Claude Code on a REMnux analysis VM. Tools used: Malcat, ILSpy, Python (cryptography, pefile, capstone), speakeasy, capa, KesaKode, ANY.RUN, Triage and tshark.

TL;DR

wsu.dll claims to be a “Windows Utility Suite”. In reality it is a 62 MB Windows program carrying a valid Extended Validation (EV) signature from Hangzhou Yueque Li Technology Co., Ltd. Nearly all of that size is Microsoft’s .NET runtime. The part the attacker actually wrote is 9.7 KB: it decrypts a small piece of code that downloads GodRAT, a remote-access trojan (RAT) built on Gh0st RAT, injects it into a hidden cmd.exe, and reports to its operator. The GodRAT file itself is byte-for-byte the one Kaspersky published in August 2025. Two weeks after signing this file, the same certificate signed IEProc.exe, a downloader for Golden Gh0st RAT, which Expel attributes to the GoldenEyeDog (APT-Q-27). Both payloads descend from the same leaked Gh0st source code, but they are different forks of it, and the certificate is the only exact link between them.

• Signed: Certum EV certificate, serial 05923499141496b67bb7b4687809454b, signed on 14 October 2026.
• Tiny real payload: a 9.7 KB .NET app hidden inside 62 MB of genuine Microsoft files.
• Two-step download: raw TCP to 103[.]145[.]191[.]136:443, which answers “GETGOD” with a 318 KB in-memory payload.
• GodRAT, unchanged: the exact DLL Kaspersky reported in 2025, from a campaign first seen in September 2024. Its real features arrive later as plugins.
• New wrapper: the signed .NET loader with AES encryption is the only new part.
• Same certificate, different toolkit: the certificate also signed IEProc.exe from the APT-Q-27 Golden Gh0st RAT campaign. That is a different Gh0st fork with its own protocol and keys.

But it’s signed!

A brand-new certificate that is immediately used to sign someone else’s product is a pattern we see again and again with signed malware. Code signing is like a sealed envelope with a sender’s name on it: it tells you who sent the file and that nobody altered it afterwards. It tells you nothing about whether the contents are safe.

This certificate was issued in August 2026 to a Hangzhou company. It has now signed two different malicious toolsets: this one on 14 October, and the IEProc.exe downloader on 29 October. It has been reported to the CA and added to the CertGraveyard.

A 62 MB haystack with a 9.7 KB needle

.NET programs can be published as a “single file”: the app, the whole .NET runtime and its libraries are packed into one big EXE. That explains the 62 MB. It is also convenient for attackers, because a scanner faces a mountain of legitimate Microsoft code to look through.

We checked the haystack first. The native launcher matches Microsoft’s official build for .NET 8.0.32 byte for byte, and all 168 bundled libraries carry valid Microsoft signatures. Everything malicious is in one 9.7 KB file called wsu.dll inside the bundle.

That file is short. It holds an encrypted blob of 1,946 bytes and a password, M!iM@mH%q$i(a)n^g, lightly disguised with XOR. It turns the password into a key, decrypts the blob with AES-GCM, and gets shellcode: raw machine instructions that run directly from memory, with no file on disk. It copies them into executable memory and starts them.

“GETGOD”

The shellcode is a stager, a small first piece whose only job is to fetch the bigger second piece. Its settings are hidden behind the marker word godinfo and decode to:

• server 103[.]145[.]191[.]136, port 443
• “inject: yes”, into C:\Windows\System32\cmd.exe

Port 443 usually means HTTPS, but there is no encryption here. The stager opens a plain TCP connection, sends the seven bytes GETGOD, and reads exactly 318,356 bytes back. It writes its settings into a fixed slot in that download and runs it.

Because nothing on the wire is encrypted, the complete second stage was sitting in the sandbox’s network capture. We recovered it from there without ever contacting the server ourselves.

The gh0st in cmd.exe

The download is a small DLL that calls itself ONLINE.dll, and we’ve met it before, or rather Kaspersky has. Its MD5 hash, 8008375eec7550d6d8e0eaf24389cf81, is exactly the one listed as GodRAT in Kaspersky GReAT’s August 2025 report. GodRAT is built on Gh0st RAT, a Chinese remote-access tool whose source code leaked in 2008 and has been forked by many crews since.

First the module hides. It starts a new cmd.exe with the argument -Puppet, frozen and with no visible window. It copies the whole 318 KB download into that process and starts it there; this is process injection, like a hermit crab moving into someone else’s shell. The original program then exits. From then on, Task Manager shows only an innocent-looking cmd.exe. The -Puppet argument is a family trademark: Kaspersky notes that GodRAT’s predecessor, AwesomePuppet, used it the same way.

From inside cmd.exe, the bot connects back to the same server and sends a login packet: computer name, user name, Windows version, local IP, and which antivirus products it found. It checks for about 25, mostly ones popular in China, such as 360, Tencent, Kingsoft and Baidu. We decoded the sandbox’s login packet; its antivirus field reads 暂未发现, “none found yet”.

Same payload, two years later

What surprised us is how little has changed. Kaspersky first saw GodRAT in September 2024, attacking trading and brokerage firms through fake “financial document” screensaver files sent over Skype. The DLL we pulled from this October 2026 sample is byte for byte the same file. Its build date reads December 2022, and Triage has a copy uploaded in December 2025 under the name qerg1.dll. Everything else in the chain also lines up with Kaspersky’s description:

Why would a payload stay frozen for two years? The DLL holds no settings of its own, because the first stage writes the server address into it. And according to Kaspersky, the GodRAT source code and builder leaked online in July 2024. Anyone with that kit can wrap the same old DLL in a new loader, which is exactly what we see here. That cuts both ways: the hash proves this is GodRAT, but it says nothing about who is running it.

A RAT that waits for its tools

This module can do little on its own. Its commands are:

• Load a plugin: receive a DLL from the server and run it in memory. Remote desktop, file manager, keylogger and the other real RAT features are delivered this way.
• Download and run a file from a URL.
• Open a web page in Internet Explorer.
• Set a nickname for the infected PC, so the operator can tag victims.
• Exit.

During the sandbox run the server sent only “you’re connected” and then kept the line open with keep-alives. It pushed no plugins. That is typical when an operator is not at the keyboard, or deliberately ignores sandbox-looking machines.

What we couldn’t see

• The plugins. The dangerous functions live in plugins the server sends on demand, and none arrived. We can’t tell what this operator wanted from victims.
• The delivery. We don’t know how victims receive “Windows Utility Suite”: a fake download site, a chat message or something else.
• Who. The shared certificate links this file to the IEProc.exe campaign, which ends in Golden Gh0st RAT (Expel’s name for the APT-Q-27 / CylindricalCanine backdoor). Both GodRAT and Golden Gh0st RAT are built on Gh0st, and both crews like disguising programs as .scr screensaver files, so the coincidence is worth noting. But Gh0st is one of the most reused RATs among Chinese-speaking crews, and when we compared the two payloads, the only overlap was code that every Gh0st descendant carries, such as compression and desktop-switching routines. The protocols differ: Golden Gh0st RAT uses WebSocket with a fixed register key, while this module uses raw TCP with its own tx framing. The servers, keys and delivery also differ. Since the GodRAT builder is public, the payload doesn’t point to any one group either. It may be one actor with two toolkits, or a certificate sold to more than one customer. We don’t attribute it.

Advice

For everyone: a valid signature with a company name is not a safety stamp. Be wary of “utility suites”, “updaters” and “cleaners” from sources you didn’t seek out yourself, especially when the company name has nothing to do with the product.

For defenders:

• Block 103[.]145[.]191[.]136.
• Hunt for cmd.exe launched with the argument -Puppet (often with two spaces before it), and for a TCP stream whose first bytes are GETGOD\0.
• Treat files signed with serial 05923499141496b67bb7b4687809454b as malicious.
• A 62 MB .NET single-file app whose own code is a few kilobytes and calls VirtualAlloc + CreateThread deserves a closer look.

Indicators of compromise

Public sandbox run: ANY.RUN.

That’s it for this one. A two-year-old GodRAT payload in a brand-new signed wrapper, and two different Gh0st toolkits from one fresh EV certificate in two weeks, is a good reminder of why we keep tracking certificates and not just files. Stay safe, and if you have a sample signed by this company, we’d love to see it.