Atlas RAT / Gh0stRAT Keylog File Written to TEMP or APPDATA

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the repeated creation of text or log files in common temporary staging directories (TEMP, APPDATA) by non-standard processes. This behavior is indicative of malware, such as Atlas RAT or Gh0stRAT, periodically flushing captured keystrokes to a file before staging for exfiltration.