Gh0stCringe (Formerly CirenegRAT)

This document is a concise opcode/command reference for a Windows remote-access malware module, listing functions such as obtaining SYSTEM privileges and shutdown, uninstall, registry modification, gathering and sending host information to C2, changing group IDs, deleting event logs, downloading/updating modules from C2, visible and covert URL opening, creating and executing files with supplied commands, displaying popups, enumerating processes and windows, loading proxy DLLs, and loading a keylogger plugin (including thread-based variants). The table highlights capabilities for privilege escalation, persistence, C2-driven modular updates, data capture (keylogging), and anti-forensics (event log removal).