zgrat | c930a47aef2b1e61adbe9ae50780323a37447743c4056fe7387d931433f25d5b

General

Target
2026-06-27_77881f5107af23fc118b924aedef3f28_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
Size 19.8MB
Sample260629-gpkswsfz2p
SHA256 c930a47aef2b1e61adbe9ae50780323a37447743c4056fe7387d931433f25d5b
MD5 77881f5107af23fc118b924aedef3f28
SHA1 6472a84849c931cc43fdde4fec4430b4ab781d93
SHA512 716d6428aef65cd5c33bed164934f9f5f803b8d49ebaa14b23e7568782e3a3764235fafe5f8cf435e079c6bd4383a478bf904aff641533efa83e90b719028ba7
SSDEEP 393216:MJkLuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98w:UMDmi3XAu5ouCZMBOg8tv
TLSH
T197273A1C1EB45723D27AD236B8A426A6AB706843E2318F0E24C597993D137326D45FFF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zgrat rat

Malware Config

Targets

- Target
  2026-06-27_77881f5107af23fc118b924aedef3f28_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
- Size 19.8MB
- SHA256 c930a47aef2b1e61adbe9ae50780323a37447743c4056fe7387d931433f25d5b
- MD5 77881f5107af23fc118b924aedef3f28
- SHA1 6472a84849c931cc43fdde4fec4430b4ab781d93
- SHA512 716d6428aef65cd5c33bed164934f9f5f803b8d49ebaa14b23e7568782e3a3764235fafe5f8cf435e079c6bd4383a478bf904aff641533efa83e90b719028ba7
- SSDEEP 393216:MJkLuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98w:UMDmi3XAu5ouCZMBOg8tv
- TLSH
  T197273A1C1EB45723D27AD236B8A426A6AB706843E2318F0E24C597993D137326D45FFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

zgrat rat
- Detect ZGRat V2
- Family: ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detects encrypted or obfuscated .NET executables
- Detects executables calling ClearMyTracksByProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V2

Family: ZGRat

Detects encrypted or obfuscated .NET executables

Detects executables calling ClearMyTracksByProcess

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2