zgRAT is a Remote Access Trojan that gives attackers complete control over infected Windows machines while simultaneously stealing credentials, browser data, and cryptocurrency wallet files. First identified in active campaigns during 2024, this malware often arrives bundled with secondary payloads like AgentTesla and targets both home users and small businesses through phishing emails and infected USB drives. What makes zgRAT particularly dangerous is its dual-purpose design—it functions as both a full remote-control tool and an aggressive information stealer, quietly exfiltrating your passwords and financial data while the attacker explores your system.
Threat Profile
| Attribute | Value |
|---|---|
| Threat Name | zgRAT |
| Threat Type | Remote Access Trojan (RAT) / Information Stealer |
| Platform | Windows (PE32 executable) |
| Primary File Type | Windows PE executable |
| First Documented | 2024 (active campaigns observed) |
| Distribution Method | Phishing emails (ZIP/LNK/BAT/XLSX attachments), infected USB drives |
| Secondary Payloads | AgentTesla, additional stealers (frequently bundled) |
| Primary Targets | Browser credentials, cryptocurrency wallets, system access |
| Persistence Mechanism | Registry Run keys, scheduled tasks |
| Network Behavior | Command-and-control (C2) communication, data exfiltration |
| Detection Aliases | zgRAT (canonical name used across AV engines) |
| Severity Rating | High (combines remote access with credential theft) |
How It Spreads
zgRAT relies primarily on social engineering to land on your computer. The most common infection vector is phishing email—messages designed to look like invoices, shipping notifications, or urgent business documents. These emails contain attachments that appear harmless (a ZIP file, an Excel spreadsheet, a shortcut file) but actually launch the malware when opened. In many cases, the attachment uses a double-extension trick (like "Invoice_2024.xlsx.exe") or arrives as a macro-laden Office document that prompts you to "Enable Content" to view the file properly.
USB-based infections are equally troubling. zgRAT can spread through infected thumb drives—either through autorun functionality (on older Windows versions without proper protections) or via shortcut files that masquerade as legitimate folders. When you plug an infected USB drive into your computer and click what looks like a folder icon, you're actually executing the malware. This infection method is especially common in workplace environments where employees share drives or use public USB charging stations.
Common distribution tactics include:
- Email attachments disguised as invoices, receipts, or delivery notices (ZIP, LNK, BAT, XLSX formats)
- Infected USB drives with malicious LNK shortcuts replacing legitimate folder icons
- Malicious Office documents with macro payloads that download and execute zgRAT
- Bundled installers for cracked software or "free" utilities downloaded from untrustworthy sites
- Watering-hole attacks targeting small-business websites with drive-by download exploits
What It Does On Your Machine
Once zgRAT executes, it immediately establishes persistence by modifying Windows Registry keys and creating scheduled tasks that ensure it runs every time you log in. The malware then contacts its command-and-control server to announce the new infection and await instructions from the operator. Unlike some automated malware, zgRAT provides interactive remote access—a human attacker can take control of your mouse and keyboard, browse your files, install additional software, or use your computer as a launching point for further attacks against your network.
Simultaneously, zgRAT's infostealer component begins harvesting credentials. It targets web browser databases (Chrome, Firefox, Edge) to extract saved passwords, autofill data, and cookies that could allow session hijacking. The malware specifically hunts for cryptocurrency wallet files—looking for directories associated with Bitcoin, Ethereum, and other wallet software—and exfiltrates those files to the attacker. It also monitors your clipboard for copied wallet addresses and can swap them in real-time, redirecting your cryptocurrency transactions to attacker-controlled wallets.
The threat becomes more severe when zgRAT delivers secondary payloads. In many observed infections, the malware downloads and executes AgentTesla, a dedicated keylogger that captures everything you type—including passwords entered on websites that don't save credentials, banking PINs, and private messages. This two-stage approach maximizes the attacker's return: zgRAT provides ongoing system access while AgentTesla ensures comprehensive credential harvesting even after the initial compromise.
Manual Removal — Step by Step
Disconnect From Network Immediately
Before doing anything else, physically disconnect the infected computer from the internet. Unplug the Ethernet cable or disable Wi-Fi. This prevents zgRAT from receiving new commands, exfiltrating additional data, or downloading secondary payloads during the removal process. Do not reconnect until you've completed all steps and verified the system is clean.
Boot Into Safe Mode With Networking
Restart the computer and press F8 repeatedly during boot (or Shift+Restart from Windows 10/11 settings). Select "Safe Mode with Networking" from the advanced boot options. This loads Windows with minimal drivers and prevents most malware from auto-starting, making it easier to isolate and remove zgRAT's components.
Check Startup Programs and Scheduled Tasks
Open Task Manager (Ctrl+Shift+Esc), click the Startup tab, and look for unfamiliar entries—especially executables with random names or located in Temp/AppData folders. Disable anything suspicious. Then open Task Scheduler (type "taskschd.msc" in Start menu), expand Task Scheduler Library, and review all tasks. Delete any tasks that run executables from user-writable directories or have suspicious triggers.
Inspect Registry Run Keys
Press Win+R, type "regedit" and press Enter. Navigate to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries pointing to executables in AppData, Temp, or other unusual locations. Right-click suspicious entries and delete them. Also check HKEY_CURRENT_USER\Software\ for any folder named "zgRAT" or similarly unusual names and delete those keys.
Locate and Delete Malicious Files
Open File Explorer and navigate to C:\Users\[YourUsername]\AppData\Local\Temp and C:\Users\[YourUsername]\AppData\Roaming. Look for recently created executable files with random names or files matching the persistence locations you found in Steps 3-4. Delete these files. Also check the Startup folder (C:\Users\[YourUsername]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup) for unfamiliar shortcuts or executables.
Run Full System Scans With Multiple Tools
While still in Safe Mode with Networking, download and run Malwarebytes (free version works fine) and perform a full Threat Scan. After that completes and removes detected items, also run Windows Defender Offline Scan (from Windows Security settings > Virus & threat protection > Scan options). Using multiple scanners catches components that single tools might miss, especially when dealing with RATs that deploy additional payloads.
Check Browser Extensions and Stored Credentials
Open each web browser you use and review installed extensions—remove anything you don't recognize or didn't intentionally install. Then clear all saved passwords (zgRAT has already stolen them, so they're compromised). In Chrome: Settings > Autofill > Passwords > Remove all. Firefox: Settings > Privacy & Security > Logins and Passwords > Remove all. You'll need to reset these passwords from a clean device.
Reset All Passwords From a Clean Device
Using a different computer, tablet, or phone that was NOT infected, immediately change passwords for all accounts you accessed from the compromised machine—especially email, banking, cryptocurrency exchanges, and any accounts with payment methods attached. Enable two-factor authentication (2FA) on everything that supports it. Assume everything you typed on the infected computer was captured.
Monitor Financial Accounts and Cryptocurrency Wallets
If you had cryptocurrency wallet files on the infected machine, immediately transfer any remaining funds to new wallets with new seed phrases generated on a clean device—the old wallets are compromised. Check bank statements and credit card transactions daily for the next 30 days. Consider placing a fraud alert on your credit report if sensitive financial data was stored on the computer.
Verify Removal and Restore Normal Operations
Restart the computer normally (not Safe Mode) and run one final full scan with both Malwarebytes and Windows Defender. If both come back clean, monitor system behavior for 48 hours—watch for unusual network activity, unexpected CPU usage, or programs launching at startup. If you see any suspicious behavior, the infection may not be fully removed, and professional assistance is recommended.
Prevention
- Treat email attachments with extreme suspicion. Never open ZIP files, Office documents, or executable files from unexpected emails—even if they appear to come from known contacts. When in doubt, contact the supposed sender through a different communication channel (phone call, separate email thread) to verify they actually sent the attachment.
- Disable macros in Office applications by default. Go into Word, Excel, and PowerPoint settings and set macro security to "Disable all macros with notification." Only enable macros for documents from verified, trusted sources where you specifically need that functionality—and even then, scrutinize the document first.
- Never use USB drives of unknown origin. Don't plug in thumb drives you find lying around, receive unsolicited in the mail, or borrow from untrusted sources. If you must use a USB drive from someone else, scan it with updated antivirus software on a non-critical machine before accessing any files. Disable AutoPlay for removable drives in Windows settings.
- Keep Windows and security software current. Enable automatic updates for Windows, and use Windows Defender (it's built-in and effective) or a reputable third-party antivirus with real-time protection. Ensure your antivirus definitions update daily—zgRAT variants evolve quickly, and yesterday's signatures won't catch today's samples.
- Use separate, dedicated devices for cryptocurrency management. If you hold significant cryptocurrency, consider a hardware wallet or a dedicated computer that never connects to email, social media, or general web browsing. This air-gap approach dramatically reduces your exposure to RATs and stealers targeting wallet files.
- Implement proper backup procedures. Maintain offline backups (external drive that you disconnect after backing up) of critical files. zgRAT infections sometimes precede ransomware deployment—having clean backups means you can restore your system without paying attackers or losing data.
- Enable multi-factor authentication everywhere possible. Even if zgRAT steals your passwords, 2FA/MFA provides a second barrier that prevents attackers from accessing your accounts. Use authenticator apps or hardware keys rather than SMS-based codes, which can be intercepted.
- Practice least-privilege computing. Don't use an administrator account for daily tasks—create a standard user account for browsing, email, and routine work. This limits malware's ability to modify system files and install persistence mechanisms, making infections easier to contain and remove.
Bring It In
Manual removal of zgRAT requires technical precision—miss a single persistence mechanism or secondary payload, and the infection comes roaring back within hours. The malware's ability to install additional threats (like AgentTesla keyloggers) means you're often dealing with multiple infections simultaneously, each requiring specialized removal techniques. At Computer Repair Roswell, we've developed systematic procedures for RAT removal that address both the primary infection and common secondary payloads. We'll forensically analyze your system to identify all compromised components, remove them completely, and verify your machine is clean before returning it.
Beyond the technical cleanup, we'll help you understand what data was likely compromised and guide you through the password-reset and account-recovery process. We'll also identify the infection vector—how zgRAT got onto your system in the first place—and help you implement practical defenses to prevent recurrence. Call us at (770) 856-1260 or visit our shop at 350 Houze Way, Roswell, GA 30076. We offer same-day diagnostics for malware infections, and in most cases, we can complete the cleanup and return your computer within 24-48 hours. Don't let zgRAT operators maintain access to your system and financial accounts—bring it in today.