False positive 2035595 - zgRAT / PureRAT confusion

Rule Signatures
1

I see rule 2035595 “ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert” getting triggered every now and then, but never for zgRAT traffic. It typically triggers when there’s PureRAT C2 traffic. I think I might have seen it alert on AsyncRAT traffic as well, but I’m not sure.

Would it make sense to rename 2035595 to “ET MALWARE Generic PureRAT/AsyncRAT Style SSL Cert”?

Here are some network indicators that I sometimes use to verify that the C2 traffic is PureRAT:

  • Default TCP port: 56001 / 56002 / 56003 (can use other ports)
  • JA3: fc54e0d16d9764783542f0146a98b300 / 07af4aa9e4d215a5ee63f9a0a277fbe3
  • Self signed X.509 cert often expires 9999-12-31 23:59:59 UTC

Here are some example sandbox executions that trigger 1:2035595:6:

2

I wrote a blog post to better explain why naming malware “zgRAT” is a bad idea.

1 Like
3

Hi erik4711,

Thank you for reaching out! Also, many thanks for providing network indicators and sandbox links for added context.

At this time, renaming the signature would not fit this rule’s intentions. Let me explain.

The rule 2035595 (ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert) was created to match on generic RAT activity with similarities to AsyncRAT and zgRAT. Our internal logs show that a majority of the matches are AsyncRAT related. It also looks like zgRAT was added to this rule message after noticing zgRAT activity in our feeds.

If this rule is alerting on PureRAT activity, then this is expected for the rule’s breadth for matching. Since AsyncRAT appear before PureRAT, I can imagine that some PureRAT activity is borrowing AsyncRAT infrastructure.

This post does spark the idea of how else can ET and other can better detect PureRAT. Do you have any particular PureRAT samples you want cover? If I understand correctly, the sandbox links provided are not PureRAT samples but just examples of 2035595 appearing in runs.

If you’re interested with creating rules that target PureRAT, we are happy to review you signature suggestions and provide feedback.

Update:
Much apologies. Discourse hide your posted link, PureLogs, PureRAT and misleading zgRAT , and I did not consider it when creating my response. I’m reading it now and the related blogs.

There is room for changing the message here. I’ll update this post again once I have more info to share.

2 Likes
4

Thank you for the update!

Clarification: The sandbox links in my original post are examples of PureRAT samples that trigger the sid 2035595 zgRAT signature. As an example, the following C2 servers can be found in the JoeSandbox PCAP:

  • 91.219.238[.]82:8541 = XWorm
  • 91.219.238[.]82:56001 = PureRAT over TLS
  • 91.219.238[.]166:8045 = DCRat over TLS
  • 91.219.238[.]166:8443 = PureLogs over TLS

The zgRAT signature 2035595 only triggers on the PureRAT traffic in the JoeSandbox PCAP. I’ve never seen that signature trigger on C2 traffic from any of the other malware families from PureCoder (such as PureLogs). That’s one of the reasons why I propose the name change from zgRAT to PureRAT for this signature.

I have now verified that I also sometimes see sid 2035595 trigger on AsyncRAT traffic.

1 Like
5

Hi @erik4711,

Thank you for your patience.

This Discourse post and your blog post, PureLogs, PureRAT and misleading zgRAT were well received by our Threat Research team who wanted to better define zgRAT internally and publicly. I would like to share our findings with you.

Origins of zgRAT Detection
The zgRAT label was created in 2021 by one of our researchers. Nothing in the code identified the malware’s name or author, so they assigned it the name zgRAT. The “zg” is “gz,” referring to gzip, in reverse and was inspired by the malware’s communication protocol. The RAT was tracked for more than five years. Relevant findings were shared with the Emerging Threats team to create ET Open and ETPro rules.

PureLogs, PureRAT, and zgRAT
Around 2022, developer PureCoder and their products began to appear in public research. Our existing zgRAT detection overlapped with the PureLogs malware. And so, we identified zgRAT as simply PureLogs related. However, your recent Discourse post and blog post encouraged our sandbox team to analyze and confirm that zgRAT == PureLogs.

Note: The 2024 ANY.RUN article was also recently reviewed for its argument that zgRAT != PureLogs. Our researchers concluded the technical details presented did not support the claim.

Around 2024, our zgRAT detection overlapped with a PureRAT sample. This lead to rules containing zgRAT and PureRAT. As of today, our Threat Research teams have concluded that zgRAT != PureRAT and those rules were queued to reflect this change.

Usage of zgRAT Going Forward

Proofpoint does not rename internally tracked malware to match names later used by Threat Actors. This choice preserves the malware family history tracked since 2021.

Going forward, our ET and ETPRO rules have been changed such that,

  • any rules related to zgRAT or PureLogs will be renamed with “zgRAT / PureLogs” and now have malware_family=PureLogs.

We believe this labeling will reduce the current public ambiguity of zgRAT’s relation to PureLogs.

Closing Thoughts

Again, the Discourse post and blog sparked discussion within our teams to better label our Pure* detections. We aim to look into PureCrypter related rules next.

Your initial request to update 2035595 “ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert” has been completed. It is now “ET MALWARE PureRAT SSL Cert” with malware_family=PureRAT. There is ongoing work to review if the AsyncRAT label and if the family should be added again as well.

I did review the YARA rule, MALWARE_Win_zgRAT, mentioned. It looks like ditekSHen commented it out, so another win to reducing False Positives and confusion!

Cheers,

Genina
:hotdog:

1 Like
6

Thank you for sharing the story about the origin of the zgRAT label Genina! I am happy to hear that Proofpoint have decided not to classify PureRAT as zgRAT, this should help clear up some confusion regarding the zgRAT label.

I respect your decision to allow the zgRAT name to be used for PureLogs malware. As long as zgRAT only maps to PureLogs, we can simply consider zgRAT to be an alias for PureLogs Stealer.

I believe you might want to keep the AsyncRAT label in the rule name for sid 2035595. Both PureRAT and AsyncRAT often use certs that match this signature.

Even though ditekSHen commented out the MALWARE_Win_zgRAT rule in their YARA repo over two years ago, it is still used today by various sandboxes and threat intel platforms. This issue is beyond what we can resolve here, but hopefully we can convince folks to stop using that problematic YARA rule by highlighting the issue.