{
  "family": "zombierat",
  "sample_count": 0,
  "category": "trojan",
  "description": "ZombieRAT (also cataloged across antimalware archives as ZombieRat, Backdoor.Win32.ZombieRat, and Zombie RAT by The Bo$$) is an early-to-mid 2000s Remote Access Trojan created in Visual Basic around 2003 by a developer using the handle 'The Bo$$'. Operating under a client-server architecture, ZombieRAT allowed unauthorized operators to connect to infected Windows 9x, ME, and 2000 workstations over direct TCP network sockets. Upon initial execution, ZombieRAT copies its executable payload into the Windows System directory, establishes persistence by creating registry entries under the Windows Run key, and listens for inbound connections. The trojan provided operators with a graphical management console offering remote surveillance and control commands, including file system browsing, file transfer, registry tampering, remote process termination, keystroke interception, desktop viewing, and disruptive hardware routines.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "ZombieRAT",
    "Backdoor.Win32.ZombieRat",
    "Zombie RAT by The Bo$$",
    "ZombieRat 1.0",
    "Backdoor:Win32/ZombieRat"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the ZombieRAT remote access trojan?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZombieRAT is an early-2000s Visual Basic remote access trojan that grants unauthorized remote control and surveillance over Windows computers."
      }
    },
    {
      "@type": "Question",
      "name": "Who developed ZombieRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "ZombieRAT was developed around 2003 by an author known as 'The Bo$$' and distributed across underground hacking forums."
      }
    },
    {
      "@type": "Question",
      "name": "What remote control actions could ZombieRAT perform?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allowed file transfers, keystroke monitoring, screen captures, process termination, registry editing, and system reboots."
      }
    },
    {
      "@type": "Question",
      "name": "How does ZombieRAT maintain persistence across reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It writes executable startup references into HKCU and HKLM Software\\Microsoft\\Windows\\CurrentVersion\\Run registry keys."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems be defended against ZombieRAT?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Block unexpected listening ports at network firewalls, monitor registry autostart keys, and deploy standard antivirus software."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2003,
  "motivation": "Unauthorized Access",
  "lineage": {
    "derived_from": [
      "Visual Basic RAT Frameworks"
    ],
    "variants": [
      "ZombieRAT 1.0",
      "ZombieRAT 2.0",
      "ZombieRAT Gold"
    ]
  },
  "exploited_cves": [],
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1113",
    "T1083",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "mitre_attack_detail": [
    {
      "id": "T1059.003",
      "name": "Command and Scripting Interpreter: Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1113",
      "name": "Screen Capture",
      "tactic": "Collection"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Disconnect the affected host from the local network to sever unauthorized remote administration sessions.",
    "Kill the active ZombieRAT server process using Task Manager or administrative tools.",
    "Remove startup keys under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.",
    "Delete the server binary from the Windows System32 directory."
  ],
  "what_to_avoid": [
    "Do not execute software attachments received from unknown senders or IRC file exchanges.",
    "Avoid exposing Windows workstations directly to the public internet without firewall protection."
  ],
  "iocs": {
    "file_hashes": [
      "c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5",
      "2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b"
    ],
    "delivery": [
      "Distribution across vintage IRC file sharing channels and P2P networks",
      "Deceptive email attachments disguised as utility updates or games"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ZombieRATServer",
      "%WINDIR%\\System32\\zombierat_sys.exe"
    ]
  },
  "sources": [
    {
      "name": "Broadcom Symantec Security Response - Backdoor.ZombieRat",
      "url": "https://www.broadcom.com/support/security-center/protection-bulletins"
    },
    {
      "name": "Malware Museum Historical RAT Collection - ZombieRAT",
      "url": "https://malware.museum"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}