🐀 #zgRAT is a #malware active since 2021 often delivered by #PrivateLoader
It can steal browser credentials, exfiltrate data to Telegram, and spread via USB

Learn more and collect #IOCs & samples
🔗 https://any.run/malware-trends/zgrat/?utm_source=mastodon&utm_medium=post&utm_campaign=zgrat&utm_content=tracker&utm_term=060125

zgRAT – Malware Trends Tracker by ANY.RUN

zgRAT a malicious RAT distributed through loader malware known for its advanced data-stealing capabilities.

zgRAT | Malware Trends Tracker

Campagne #Malware #Italy Week 20

☠️🔥💣👻
#AgentTesla: Bozza Contratto
#Guloader: Ordine
#Formbook: Pagamento
#ZGRat: Contratto
#Irata: APK Bank
#PureLogs: Documenti
#Nanocore: Fattura
#LokiBot: Delivery
#RemcosRat: Ordine

#mwitaly

Campagne #Malware #Italy Week 18

☠️🔥👻💣
#AgentTesla: Ordine
#Formbook: Offerta
#Irata: APK Bank
#Remcos: Modulo
#ZGRat: Offerta
#DarkCloud: Ordine
#LockBit: Photo
#DarkGate: Report

#mwitaly

Campagne #Malware #Italy Week 15

👻💣🔥☠️
#AgentTesla: Ordine
#Formbook: Fattura
#SpyNote #Irata: APK Bank - INPS
#Guloader: Contratto
#DarkGate: Documento
#Remcos: Offerta
#ZGRat: Booking
#mwitaly

Campagne #Malware #Italy Week 14

👻💣🔥☠️
#AgentTesla: Bonifico
#Irata: APK Bank
#Remcos: Offerta
#ZGRat: Booking
#XWorm: Aggionamenti
#Formbook: Fattura
#mwitaly

@malware_traffic This #zgRAT sample makes a new connection to the C2 server (5.188.159.44:39001) almost every second. A few other samples show similar behavior. These reconnections could be caused by a C2 polling mechanism, but another theory is that they are the result of some error in the C2 comms.
https://www.joesandbox.com/analysis/1351112
Automated Malware Analysis - Joe Sandbox Cloud Basic

Joe Sandbox Cloud Basic Interface