zgRAT malware
zgRAT is a .NET remote access trojan and stealer frequently delivered through crypters and loaders alongside other commodity families.
Malva.RE has analysed 8 public samples tagged zgRAT, statically and without execution. The latest public sample was seen on 2026-08-07.
File types
- PE Executable7
- PowerShell1
Latest public zgRAT samples
| Sample | Type | First seen |
|---|---|---|
| 4e4e32f6259b82e6b932ab81172c22560ec2ac46e85543d4851637a63eaace3e | PE Executable | 2026-08-07 |
| ffb24fc36ade87988f9908e848d0333ce7ffb2b4e4d0ffb43f6556246069d057 | PE Executable | 2026-01-21 |
| 3754676df0025fafd46779673f09048b727b01e636295d2fdf8695f5a884ef33 | PE Executable | 2025-12-29 |
| 030eac7d568cdbcf9ab1015ca14a0e392c54eaa4e0b15c77ee659ff1d4432d29 | PE Executable | 2025-08-06 |
| 73e98959ba26951a9cd9e63eb56a25bd21f959d9388601258ca64851f298d78f | PE Executable | 2025-07-23 |
| 788fd090e31d7978c2e10bd20393d621c693b48c45028809e6263b8687eda68e | PE Executable | 2025-07-09 |
| a996820cb822991e67157df2cf3c506845937de58e31eef0daa8c116e0e61e9d Tbmfufj.exe |
PE Executable | 2025-04-22 |
| 28adff809baac70a406306824a50283b2d76b1ad160b806d12d1b4d5c9ea0aec 28ADFF809BAAC70A406306824A50283B2D76B1AD160B806D12D1B4D5C9EA0AEC.ps1 |
PowerShell | 2025-04-22 |
Analyse your own zgRAT sample
Malva.RE unpacks, decompiles and extracts the configuration of suspicious files statically — the file is never executed. Free-plan reports are public.
Analyse a file for free