zgrat | 1603f86a42ce554c778991a521beb60369da42e664d2669e7effabf9932bddae

General

Target
2026-08-25_98f7386ca040ec9968f26a3379e92fec_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
Size 19.8MB
Sample260826-ts28kascpf
SHA256 1603f86a42ce554c778991a521beb60369da42e664d2669e7effabf9932bddae
MD5 98f7386ca040ec9968f26a3379e92fec
SHA1 9a523f51011c83ab73b038856b7407c9212c7fe0
SHA512 0b7e1273c193ebc6d84ae7c83343927ba6da33cff276b03bb51d2e622827ac3bd492593a1b273ba3f403bcceb8ce0568f9e16d2990b489b78d75e2a27c894c63
SSDEEP 393216:AZpuuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98m:cRMDmi3XAu5ouCZMBOg8tZ
TLSH
T145274B1C1EB45723D27AD236B8A426A6AB706843F2318F0E24C597993D137326D45FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

zgrat rat

Malware Config

Targets

- Target
  2026-08-25_98f7386ca040ec9968f26a3379e92fec_agent-tesla_cobalt-strike_coinminer_dcrat_glassworm_hijackloader_icedid_poet-rat_quasar-rat_satacom_stealc_vidar
- Size 19.8MB
- SHA256 1603f86a42ce554c778991a521beb60369da42e664d2669e7effabf9932bddae
- MD5 98f7386ca040ec9968f26a3379e92fec
- SHA1 9a523f51011c83ab73b038856b7407c9212c7fe0
- SHA512 0b7e1273c193ebc6d84ae7c83343927ba6da33cff276b03bb51d2e622827ac3bd492593a1b273ba3f403bcceb8ce0568f9e16d2990b489b78d75e2a27c894c63
- SSDEEP 393216:AZpuuMDmi3XAu5ouCYzASfV4A3mDDDy/WTALOg8Bb98m:cRMDmi3XAu5ouCZMBOg8tZ
- TLSH
  T145274B1C1EB45723D27AD236B8A426A6AB706843F2318F0E24C597993D137326D45FFE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

zgrat rat
- Detect ZGRat V2
- Family: ZGRat
  ZGRat is remote access trojan written in C#.
  rat zgrat
- Detects encrypted or obfuscated .NET executables
- Detects executables calling ClearMyTracksByProcess
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Detect ZGRat V2

Family: ZGRat

Detects encrypted or obfuscated .NET executables

Detects executables calling ClearMyTracksByProcess

Checks computer location settings

Deletes itself

Executes dropped EXE

Loads dropped DLL

Contacts third-party web service commonly abused for C2

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2