The first byte of Figure 3 shows the value 0x66, which is the Gh0st RAT code for "login". After sending the initial phonehome request, Gh0st RAT exchanges 22-byte 'command' packets with its command and control (C2) server. Once again,