Malware Spotlight:  A Deep-Dive Analysis of WezRat

This Check Point Research report analyzes WezRat, a modular infostealer/backdoor used by the Iranian-linked group Emennet Pasargad, describing a phishing campaign that distributed a malicious MSI disguised as a Chrome update to Israeli organizations. The analysis covers the backdoor's C++ implementation, DLL-based modular features (screenshots, keylogger, clipboard and cookie theft, file upload), C2 protocol and endpoints, evolution of samples and backend code, and provides IOCs (SHA256 hashes and server domains) and mitigation notes.