False positive 2035595 - zgRAT / PureRAT confusion

Rule Signatures
1

I see rule 2035595 “ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert” getting triggered every now and then, but never for zgRAT traffic. It typically triggers when there’s PureRAT C2 traffic. I think I might have seen it alert on AsyncRAT traffic as well, but I’m not sure.

Would it make sense to rename 2035595 to “ET MALWARE Generic PureRAT/AsyncRAT Style SSL Cert”?

Here are some network indicators that I sometimes use to verify that the C2 traffic is PureRAT:

  • Default TCP port: 56001 / 56002 / 56003 (can use other ports)
  • JA3: fc54e0d16d9764783542f0146a98b300 / 07af4aa9e4d215a5ee63f9a0a277fbe3
  • Self signed X.509 cert often expires 9999-12-31 23:59:59 UTC

Here are some example sandbox executions that trigger 1:2035595:6:

2

I wrote a blog post to better explain why naming malware “zgRAT” is a bad idea.

1 Like
3

Hi erik4711,

Thank you for reaching out! Also, many thanks for providing network indicators and sandbox links for added context.

At this time, renaming the signature would not fit this rule’s intentions. Let me explain.

The rule 2035595 (ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert) was created to match on generic RAT activity with similarities to AsyncRAT and zgRAT. Our internal logs show that a majority of the matches are AsyncRAT related. It also looks like zgRAT was added to this rule message after noticing zgRAT activity in our feeds.

If this rule is alerting on PureRAT activity, then this is expected for the rule’s breadth for matching. Since AsyncRAT appear before PureRAT, I can imagine that some PureRAT activity is borrowing AsyncRAT infrastructure.

This post does spark the idea of how else can ET and other can better detect PureRAT. Do you have any particular PureRAT samples you want cover? If I understand correctly, the sandbox links provided are not PureRAT samples but just examples of 2035595 appearing in runs.

If you’re interested with creating rules that target PureRAT, we are happy to review you signature suggestions and provide feedback.

Update:
Much apologies. Discourse hide your posted link, PureLogs, PureRAT and misleading zgRAT , and I did not consider it when creating my response. I’m reading it now and the related blogs.

There is room for changing the message here. I’ll update this post again once I have more info to share.

2 Likes
4

Thank you for the update!

Clarification: The sandbox links in my original post are examples of PureRAT samples that trigger the sid 2035595 zgRAT signature. As an example, the following C2 servers can be found in the JoeSandbox PCAP:

  • 91.219.238[.]82:8541 = XWorm
  • 91.219.238[.]82:56001 = PureRAT over TLS
  • 91.219.238[.]166:8045 = DCRat over TLS
  • 91.219.238[.]166:8443 = PureLogs over TLS

The zgRAT signature 2035595 only triggers on the PureRAT traffic in the JoeSandbox PCAP. I’ve never seen that signature trigger on C2 traffic from any of the other malware families from PureCoder (such as PureLogs). That’s one of the reasons why I propose the name change from zgRAT to PureRAT for this signature.

I have now verified that I also sometimes see sid 2035595 trigger on AsyncRAT traffic.

1 Like