KCP

From GhostNet to PseudoManuscrypt - The evolution of Gh0st RAT - Jorge Rodriguez; Souhail Hammou

Gh0stKCP Protocol

| | CapLoader, Gh0stKCP, Ghost, KCP, PseudoManuscrypt, Suricata, ValleyRAT, WinOS, Winos4.0, Yara
Gh0stKCP is a command-and-control (C2) transport protocol based on KCP. It has been used by malware families such as PseudoManuscrypt and ValleyRAT/Winos4.0. @Jane_0sint recently tweeted about ValleyRAT using a new UDP based ...
NETRESEC Network Security Blog