Netskope Threat Labs

GruntStager

ATP Sandbox Adv. HeuristicsAV

GruntStager is a .NET-based trojan associated with the Covenant command and control framework that stages additional payloads on infected systems.

First seen
August 2022
Last seen
October 2026
Alert Name
ByteCode-MSIL.Trojan.GruntStager
Generic.GruntStager.A.00D49AA3
Generic.GruntStager.A.0FC59C8C
Generic.GruntStager.A.11B205AE
Generic.GruntStager.A.1847AED1
Generic.GruntStager.A.1A8D5DFB
Generic.GruntStager.A.20ADF47A
Generic.GruntStager.A.34DBAF7F
Generic.GruntStager.A.404DC865
Generic.GruntStager.A.48B374A9