SYMBOLCOMMON_NAMEaka. SYNONYMS
win.zgrat (Back to overview)

zgRAT

zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets.
Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.

References
2026-07-27 ⋅ Netresec ⋅ Erik Hjelmvik
PureLogs, PureRAT and misleading zgRAT
PureLogs Stealer PureRAT zgRAT
2023-02-03 ⋅ Cloudsek ⋅ Deepanjli Paulraj, Pavan Karthick M
Threat Actors Abuse AI-Generated Youtube Videos to Spread Stealer Malware
Alfonso Stealer Bandit Stealer Cameleon Fabookie Lumma Stealer Nanocore RAT Panda Stealer RecordBreaker RedLine Stealer Stealc STOP Vidar zgRAT
2023-01-16 ⋅ Difesa & Sicurezza ⋅ Francesco Bussoletti
Cybercrime, RFQ from Turkey carries AgentTesla and zgRAT
Agent Tesla zgRAT
2022-11-17 ⋅ Trellix ⋅ Trelix
Trellix Insights: SmokeLoader Exploits Old Vulnerabilities to Drop zgRAT
SmokeLoader zgRAT
2022-08-08 ⋅ Fortinet ⋅ James Slaughter
Life After Death - SmokeLoader Continues to Haunt Using Old Vulnerabilities
SmokeLoader zgRAT
2021-08-06 ⋅ abuse.ch ⋅ abuse.ch
zgRAT malware samples
zgRAT

There is no Yara-Signature yet.