zgrat | 70ea08cf1ea9c9c14a597c7ebc5f72b5e822db7af7a6c2b2c56b595cea065367

General

Target
2026-07-18_997842dffbc428856346bbc8adb70cd3_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
Size 19.8MB
Sample260718-3rlzmaft9n
SHA256 70ea08cf1ea9c9c14a597c7ebc5f72b5e822db7af7a6c2b2c56b595cea065367
MD5 997842dffbc428856346bbc8adb70cd3
SHA1 076356362cb9406dab46cee51e7ece43032a1c82
SHA512 9e42eb1c7da2cc7161ecce1e1a265299067d5b18cef2b1a8c65d146a36d6bf7013ee4f948187b8146922ac04ef4ff13200b4050a43d2739d8aa861d414eebe40
SSDEEP 393216:k5bzVuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb983:I8MDmi3XAu5ouCZMBOg8tg
TLSH
T1A9274A1C1EB45723D27AD236B8A426A6AB706843F2318F0E24C597993D137326D45FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zgrat rat

Malware Config

Targets

- Target
  2026-07-18_997842dffbc428856346bbc8adb70cd3_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
- Size 19.8MB
- SHA256 70ea08cf1ea9c9c14a597c7ebc5f72b5e822db7af7a6c2b2c56b595cea065367
- MD5 997842dffbc428856346bbc8adb70cd3
- SHA1 076356362cb9406dab46cee51e7ece43032a1c82
- SHA512 9e42eb1c7da2cc7161ecce1e1a265299067d5b18cef2b1a8c65d146a36d6bf7013ee4f948187b8146922ac04ef4ff13200b4050a43d2739d8aa861d414eebe40
- SSDEEP 393216:k5bzVuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb983:I8MDmi3XAu5ouCZMBOg8tg
- TLSH
  T1A9274A1C1EB45723D27AD236B8A426A6AB706843F2318F0E24C597993D137326D45FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

zgrat rat
- Detect ZGRat V2
- Family: ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detects encrypted or obfuscated .NET executables
- Detects executables calling ClearMyTracksByProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V2

Family: ZGRat

Detects encrypted or obfuscated .NET executables

Detects executables calling ClearMyTracksByProcess

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2