EtherRAT Config JSON File Creation

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•3

Detects the creation of a file named 'svchost.log' in a randomly named subdirectory within 'AppData\Local', which is indicative of EtherRAT malware storing its base64 encoded JSON configuration.