Gh0st RAT is a Trojan horse for the Windows platform. The “RAT” part of the name refers to the software’s ability to operate as a "Remote Administration Tool". It is a cyber spying computer program used to control infected Windows computers remotely. Gh0st RAT is installed on computers through other malware that opens a ‘backdoor’. This allows cyber criminals to control the infected computers. Gh0st RAT has been used in many cyber espionage/targeted attacks like “Gh0stnet” which was targeted against the compromise of computer systems owned by the Private Office of the Dalai Lama, and several other Tibetan enterprises. Gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses. Gh0st RAT has encrypted TCP communications to evade detection. It uses RC4 and XOR to encrypt C2 traffic.