zgrat | 690c1539d83ac5e51289a961247a339c462ae9ac1074f9aec93ecbd64e7e3217

General

Target
2026-05-04_1a0e99182213be18be3d1cfceebaa750_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
Size 19.8MB
Sample260504-mmm35acw7k
SHA256 690c1539d83ac5e51289a961247a339c462ae9ac1074f9aec93ecbd64e7e3217
MD5 1a0e99182213be18be3d1cfceebaa750
SHA1 71a28893f0d6a812cf5b85702c1274148057f5c7
SHA512 7cfe9f0ab2bf88266215565ed72e47fa07187c62eb401c07df1162aaa7f721f67a1c9f163a29a4b7f361e479557a6dcc45a494476105d94b9567b8f586242351
SSDEEP 393216:LFK6toIRuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98T:BK6uIMMDmi3XAu5ouCZMBOg8tk
TLSH
T114273A1C1EB45723D27AD236B8A426A6BB706843E2318F0E24C597993D137326D45FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zgrat rat

Malware Config

Targets

- Target
  2026-05-04_1a0e99182213be18be3d1cfceebaa750_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
- Size 19.8MB
- SHA256 690c1539d83ac5e51289a961247a339c462ae9ac1074f9aec93ecbd64e7e3217
- MD5 1a0e99182213be18be3d1cfceebaa750
- SHA1 71a28893f0d6a812cf5b85702c1274148057f5c7
- SHA512 7cfe9f0ab2bf88266215565ed72e47fa07187c62eb401c07df1162aaa7f721f67a1c9f163a29a4b7f361e479557a6dcc45a494476105d94b9567b8f586242351
- SSDEEP 393216:LFK6toIRuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98T:BK6uIMMDmi3XAu5ouCZMBOg8tk
- TLSH
  T114273A1C1EB45723D27AD236B8A426A6BB706843E2318F0E24C597993D137326D45FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

zgrat rat
- Detect ZGRat V2
- Family: ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detects encrypted or obfuscated .NET executables
- Detects executables calling ClearMyTracksByProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V2

Family: ZGRat

Detects encrypted or obfuscated .NET executables

Detects executables calling ClearMyTracksByProcess

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2