GopherRAT Removal Guide: Stop File Theft and Network Access on Windows PC

A security alert names GopherRAT, yet the computer still opens files and looks ordinary. It is tempting to dismiss the warning and finish your work.

Before doing that, find out what the alert actually detected. With this threat, the most important activity may not appear on the desktop at all.

Overview

GopherRAT gives an outsider access to files and commands

GopherRAT is a Go-based remote-access Trojan documented in WithSecure’s Andariel research. Its analyzed Windows implant supports file operations, command execution, and network tunneling.

Those functions let an operator do more than observe a single application. The compromised endpoint can become a way to retrieve documents or reach other network resources.

WithSecure associated the tooling with its investigation of Andariel activity. That attribution does not identify who is behind every alert carrying a similar detection label.

The reported implant is not a universal infection story

The research connects GopherRAT with infrastructure examined during an ERP-related investigation. Researchers could not retrieve a particular downloader’s next stage at the time.

It would therefore be misleading to claim every GopherRAT infection arrived through the same software update. Your own download and execution records still matter.

The published Windows sample supports this guide’s platform choice. Code hints about Linux are not confirmation that an equivalent Linux build was recovered and tested.

Containment matters even without a ransom note

A remote-access Trojan does not need to encrypt files to cause harm. Quietly copying a business folder can be serious even when every original document still opens.

Useful priorities include:

• Isolating the endpoint without destroying evidence needed by responders.
• Reviewing accessible folders, shares, and privileged sessions.
• Removing the implant and investigating anything it launched.
• Recovering accounts exposed during the intrusion.

How to Remove GopherRAT From Windows

For a work or school computer, contact its IT or security team before installing tools or restarting. Its investigation may need evidence from the running system.

If remote access is suspected, disconnect Wi-Fi or Ethernet and stop using this PC for sensitive accounts. Arrange trusted downloads and updates before proceeding with cleanup.

Start with Malwarebytes. HitmanPro and ESET are optional second opinions for unresolved findings or continuing symptoms. Run one scanner at a time.

• STEP 1: Use RKill only if malware blocks your scanner
• STEP 2: Scan and quarantine threats with Malwarebytes
• STEP 3: Optional: Check unresolved threats with HitmanPro
• STEP 4: Optional: Run a second-opinion scan with ESET

Step 1: Use RKill only if malware blocks your scanner

RKill attempts to stop known malware processes so your security software can run. It does not remove the infection.

Use it only on a personal Windows PC when malware is blocking your scanner. Otherwise, skip directly to Malwarebytes.

1. Download Rkill.

   Download RKill using the button below. On the download page, choose the iExplore.exe version.

   This is a renamed copy of RKill, provided for infections that block security tools by filename.

   RKillStops malware processes so other tools can run

   Download RKillOpens the BleepingComputer download page in a new tab.

2. Run RKill.

   Open your Downloads folder and double-click iExplore.exe. Allow the program time to finish checking for processes that interfere with cleanup.

   

   When the black window closes, a log opens. Keep the log, do not restart yet, and continue directly to Malwarebytes.

Step 2: Scan and quarantine threats with Malwarebytes

Malwarebytes for Windows can scan for malware and quarantine detected threats. Use the free Custom Scan below; a paid plan is not required for this cleanup.

1. Download Malwarebytes

   Click the button below to download Malwarebytes for Windows. Paid real-time protection is optional.

   Malwarebytes Free for WindowsScans and removes malware at no cost

   Download MalwarebytesMalwarebytes free scanner informationOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium

2. Install Malwarebytes

   When the download finishes, open Downloads and double-click MBSetup. If Windows asks for permission, check that the prompt identifies Malwarebytes, then click Yes.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   Installer screens and optional offers vary. Skip unwanted Browser Guard, trial, or paid-plan offers. The free Custom Scan remains available; Threat Scan may require a paid plan.

   • Choose Personal for your own computer, then click Next. For a work-managed device, use your organization’s approved response instead.

     

   • Wait for installation to finish.

     

   • If the Welcome to Malwarebytes screen appears, click Get started and follow the remaining prompts.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Choose the scan type and optional rootkit check

   On the Scanner tile, click the three dots, choose Advanced Scan, then Custom Scan.

   Expand the folder selector and select the C:\ system drive. Include any other drive where the suspicious files were stored.

   If Scan for rootkits is available, you can enable it. This setting is unavailable on Windows ARM devices; leave Windows security protections enabled.

   Review how potentially unwanted programs and modifications will be handled. Keep detection enabled rather than automatically ignoring these items.

5. Start the Scan

   Click Start Custom Scan. Allow Malwarebytes to update its detection information if prompted.

6. Wait for the Scan to Finish

   Wait for the Custom Scan to finish. The time required depends on the selected locations and the amount of data.

7. Quarantine the Detected Threats

   When the scan finishes, review the detections and keep the threats you want removed selected. Click Quarantine.

   If a detection is unclear, save the report and ask for help before excluding or restoring it.

   

   Wait while Malwarebytes quarantines the selected items. Do not restore a file merely because an unfamiliar name appears in the results.

   

8. Restart Your Computer

   If Malwarebytes asks for a restart, save your work and click Yes. After signing back in, reopen Malwarebytes and check the report for unresolved detections.

   

Step 3: Optional: Check unresolved threats with HitmanPro

HitmanPro is a second-opinion scanner for Windows. It examines suspicious files using cloud analysis, including SophosLabs. An internet connection is needed for that check.

Scanning is free. Removing detections requires an eligible one-time 30-day trial or a paid license.

A computer that already used its trial may not qualify again. You do not have to buy HitmanPro to follow the Malwarebytes cleanup above.

1. Download HitmanPro

   Click the button below to download HitmanPro if you want a second opinion on unresolved symptoms or detections.

   HitmanProSecond-opinion malware scanner from Sophos

   Download HitmanProFree scan. Removal requires an eligible 30-day trial or a paid license. Opens the official HitmanPro page in a new tab.

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click Next. Read and accept the terms if you agree, then continue.

   

   Choose whether to keep a copy for later use or run a one-time scan. Review optional startup and email preferences, then click Next.

   

4. Wait for the Scan to Finish

   Let HitmanPro finish scanning. Review its findings once the scan has completed.

   

5. Review the Results and Click “Next”

   Review the detected items and their proposed actions. Save the log if you need help with an unfamiliar detection, then click Next to proceed.

   

6. Click “Activate Free License”

   If this computer qualifies, click Activate free license and follow the activation prompts.

   If no trial is available, use an existing license or save the report for assistance. Do not assume a purchase is necessary to continue cleanup.

   

   After removal, review the summary and click Next. Choose Reboot if requested, or Close if no restart is needed.

   If detections return or the original symptoms persist, keep the reports and ask for help. A clean scan cannot rule out every threat.

Step 4: Optional: Run a second-opinion scan with ESET

ESET Online Scanner is a free second-opinion scanner for Windows. Use it if you need another check after cleanup, rather than running several scanners together.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   ESET Online ScannerFree one-time malware scan from ESET

   Download ESET Online ScannerOpens the official download page in a new tab.

2. Run the Installer

   When the download finishes, open Downloads and double-click esetonlinescanner.exe. Approve the Windows permission prompt after checking that it identifies ESET.

   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   Read the Terms of use. Click Accept if you agree, then Get started if that screen appears again.

   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.

   

4. Start a Full Scan

   Click Full Scan for a broader check than the quick-scan option.

   

   Select Enable for Detection of Potentially Unwanted Applications. Then click Start scan.

   

5. Wait for the Scan to Finish

   Allow the detection modules to download and update. The file scan begins afterward.

   Leave the scan running until it finishes. A full scan can take an hour or longer, depending on your computer and the data being checked.

   

6. Review the Results

   When the scan finishes, open View detailed results and check the action recorded for each detection.

   ESET attempts to clean and quarantine detected threats. If an item remains unresolved, keep its details for assistance.

   Click Save scan log to keep the results. Then click Continue.

   

   Restart if ESET requests it. Afterward, check whether detections or the original symptoms return.

   If problems continue, keep the scan reports and ask for help in the MalwareTips removal forum. Do not repeatedly restore quarantined files.

Technical Details Worth Knowing

The implant establishes a command connection

The analyzed program begins by contacting its configured server and completing a custom handshake. That connection is how an outside operator can issue instructions.

A device identifier helps the operator track the endpoint

GopherRAT derives an identifier from information about the computer’s network adapter. This lets the operator recognize an endpoint across its command communications.

File and drive listings reveal useful material

Commands can enumerate drives and directories, describe files, and retrieve files or folders. An operator can learn where valuable material is kept before copying it.

Commands and additional files change the scope

The RAT can execute commands and binaries, write files, and perform other filesystem operations. What happens next depends on instructions and access available to the operator.

A tunnel makes the victim’s network position useful

SOCKS tunneling can relay traffic through the infected machine. To another system, a connection may appear to originate from an endpoint already inside a trusted network.

Organizations should examine related access and network logs, not only the first PC. Shared credentials and reachable resources can extend the incident beyond that endpoint.

What the Original Research Does and Does Not Establish

WithSecure described several different implants in the same investigation. GopherRAT should not inherit every function of JelusRAT, StarshellRAT, or another tool found nearby.

For example, file transfer and tunneling are documented GopherRAT capabilities. A webcam or keylogging claim needs its own evidence rather than an assumption about all RATs.

Similarly, a Korean text-encoding feature is a technical observation, not a reliable way for a home user to identify an attacker or diagnose an infection.

If your alert names GopherRAT, retain the exact vendor label, detected path, and report time. Different vendors can label the same specimen differently.

Do not download a malware sample to settle the question yourself. A responder can compare existing evidence without introducing another dangerous executable into your environment.

What to Do If GopherRAT Is Found on Your Computer

1. Remove the endpoint from ordinary network use. Unplug its wired connection and turn off Wi-Fi. Do not use a tunnel-capable compromised machine for recovery logins.

2. Tell the responsible people. On a business device, notify the security team and identify shares, customer material, or administrator sessions the machine could access.

3. Retain the evidence already available. Keep alerts, filenames, report timestamps, and any relevant messages. Let responders decide whether memory collection must precede a reboot.

4. Protect exposed identities away from the endpoint. Review suspicious account access and replace affected credentials on a trustworthy system. Revoke unauthorized sessions where supported.

5. Perform the appropriate cleanup. Personal Windows users can follow the illustrated scan procedure. Managed environments need containment and scope analysis before consumer tools.

6. Review possible file disclosure. Ask which material the intruder could reach. A completed quarantine does not answer whether sensitive documents were copied earlier.

Restoring Files and Network Trust Without Restoring the Intrusion

Keep essential document backups separate from suspect executables. Copying an entire compromised system image back onto a rebuilt machine can restore the original problem.

Do not reconnect every mapped drive as soon as a scan ends. A business responder may need to reset access, examine adjacent systems, or restrict a share first.

If essential files disappeared or changed, preserve backups and available versions. Avoid writing new material onto a storage device being considered for specialist data recovery.

A GopherRAT detection alone does not establish ransomware encryption. Do not buy a decryptor or follow a supposed ransom-payment procedure without identifying an actual encryption incident.

Document what was recovered, what remains uncertain, and who approved returning the device to use. That is more useful than relying on the computer seeming faster.

Frequently Asked Questions

What does GopherRAT do?

The analyzed Go implant supports remote commands, file and folder transfer, filesystem discovery, and SOCKS tunneling. Those functions provide unauthorized access to an infected endpoint.

Does finding GopherRAT mean my documents were encrypted?

No. A RAT can copy or manipulate data without encrypting it. Investigate actual changes instead of assuming every remote-access incident is ransomware.

Is the Linux version confirmed by this research?

The report describes code suggesting Linux support might exist. This Windows removal guide does not treat that hint as a recovered and verified Linux variant.

Can the attacker use my network through GopherRAT?

Its tunneling capability can relay connections through the endpoint. Disconnect the affected machine and have relevant network access examined when a compromise is confirmed.

Will deleting the detected file close every route in?

Not necessarily. Additional components, altered settings, or exposed credentials may remain. Follow the execution chain and review related access rather than deleting one filename blindly.

When should a workplace device be restarted?

Follow the incident team’s direction. Restarting can remove useful memory evidence, while continued network access can permit harm. Containment and evidence priorities need to be coordinated.

The Bottom Line

Treat a confirmed GopherRAT infection as unauthorized device and network access. Do not keep the endpoint connected while using it for sensitive work.

Isolate it, arrange removal or a planned rebuild, and review exposed accounts and files. A scan result is part of recovery, not its entire conclusion.