TA4922 Atlas RAT / Gh0stRAT Periodic Screenshot File Creation in TEMP Directory

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects periodic image file creation (e.g., .bmp, .png, .jpg) in user-writable temporary or application data directories by non-UI processes. This pattern is consistent with the behavior of remote access trojans (RATs) such as Atlas RAT and Gh0stRAT, which capture screenshots and stage them for exfiltration.