BlackTech__2021__Malware_Gh0stTimes_Used_by_BlackTech_-_JPCERT_CC_Eyes_JPCERT_Coordination_Center_official_Blog.pdf

JPCERT/CC provides a technical analysis of Gh0stTimes (a Ghost RAT derivative) used by the BlackTech APT: detailing its custom C2 protocol (ID/key exchange, XOR/RC4+zlib payloads), command modules (FileManager, ShellManager, PortmapManager, UltraPortmapManager), control-panel screenshots ("Times v1.2"), dummy code samples, Python decoding example, and an appendix of IoCs (C2 domains/IPs and malware hashes) to aid detection and response.