MalwareUsed by 1 actor

zgRAT

zgRAT is a Windows malware label used in the wild for payloads delivered in phishing and malware-delivery chains, but the name is inconsistently applied and does not map cleanly to a single, well-defined family. Security reporting has associated the label with malware distributed through loaders and crypters such as Cruciferra, DOILoader, Rhadamanthys, StealC, and CastleLoader, including campaigns targeting hospitality, travel, and other business sectors with social-engineering lures such as guest complaints, tax themes, and Booking.com impersonation. Observed delivery methods include phishing, ClickFix-style user execution, malicious archives, PowerShell-based staging, and DLL sideloading.

Attribution of capabilities under the zgRAT name is complicated by naming ambiguity. Some analysts map zgRAT to PureLogs, a .NET infostealer associated with theft of credentials, browser cookies, financial data, cryptocurrency-wallet data, VPN credentials, and other sensitive information, with exfiltration sometimes occurring over TLS and in some cases via Discord webhooks. Other analysts map zgRAT to PureRAT, a .NET remote-access trojan associated with Hidden VNC, remote desktop control, webcam and microphone access, keylogging, reverse proxying, code injection, and broader interactive post-compromise control. Because both PureLogs and PureRAT have been labeled zgRAT by different vendors and detections, the term is best treated as an ambiguous umbrella label rather than a deterministic family name.

High-confidence reporting shows that malware called zgRAT has been used in financially motivated intrusion activity and commonly appears alongside other commodity stealers and RATs. It has been observed in campaigns against hospitality and travel organizations, including operations using Booking.com-themed lures and DLL sideloading chains, and in other phishing campaigns where it followed loaders or stealers such as Rhadamanthys. The malware associated with this label is therefore linked at minimum to credential theft, session theft through browser-cookie collection, exfiltration, and in some cases broader remote-access and surveillance functions. Precise family classification should be made cautiously and, where possible, replaced with the more specific family names PureLogs or PureRAT when technical evidence supports that distinction.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Aggah

This PowerShell script ran Rhadamanthys malware. Rhadamanthys was then observed to download and run zgRAT.

via proofpointproofpoint.com

MITRE ATT&CK

Techniques & procedures

23 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

3 techniques

T1566PhishingEvidence4

Proofpoint’s research team traced a wave of income-tax-themed lures targeting Indian taxpayers, tax professionals, and corporate finance teams... TA4922 sent victims to fake landing pages hosting ZIP files disguised as tax documents...

T1566.001Spearphishing AttachmentEvidence1

These messages contained URLs leading to the download of a VHD file which, if clicked, ran an executable which ran Cruciferra.

T1566.002Spearphishing LinkEvidence3

The URLs leading to these landing pages were delivered either directly within the email body or via PDF attachments cotaining embedded links.

Execution

5 techniques

T1059.001PowerShellEvidence3

These messages contained URLs masquerading as links to evidence provided by a guest, but led to the download of a zipped LNK file that launched a PowerShell command, which then executed a PowerShell script.

T1059.007JavaScriptEvidence1

These messages contained URLs leading to a download of a JavaScript file hosted on Microsoft Azure. The JavaScript called PowerShell to run a remote PowerShell script.

T1204User ExecutionEvidence2

These messages contained URLs leading to a download of a JavaScript file hosted on Microsoft Azure. The JavaScript called PowerShell to run a remote PowerShell script.

T1204.001Malicious LinkEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious Link T1204.001 ClickFix/FakeCaptcha pages

T1204.002Malicious FileEvidence1

The RAR file contained the executable “Rechnung DE009100019000.exe”... When the .exe was executed, it sideloaded the included PYTHON27.DLL...

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 HKCU...\CurrentVersion\Run

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 HKCU...\CurrentVersion\Run

Stealth

4 techniques

T1027.002Software PackingEvidence2

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files: Software Packing T1027.002 Donut + .NET Reactor + ZgRAT (three-layer packing)

T1036MasqueradingEvidence1

...fake landing pages hosting ZIP files disguised as tax documents... One wave impersonated the US Social Security Administration...

T1036.005Match Legitimate Resource Name or LocationEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Match Legitimate Name T1036.005 msedge_elf.dll, libpsl-5.dll

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497 Benign API calls (catfact.ninja, httpbin.org) for timing

Credential Access

2 techniques

T1539Steal Web Session CookieEvidence1

According to Trellix's data, various malware families, including Agent Tesla, UmbralStealer, Stealerium, and zgRAT, have also used Discord webhooks over the past few years to steal sensitive information like credentials, browser cookies, and cryptocurrency wallets from compromised devices.

T1649Steal or Forge Authentication CertificatesEvidence1

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Owner/User Discovery T1033 Username, admin status collection

T1082System Information DiscoveryEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Information Discovery T1082 PS1 fingerprinting (OS, model, AV products)

T1497Virtualization/Sandbox EvasionEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497 Benign API calls (catfact.ninja, httpbin.org) for timing

Collection

1 technique

T1560Archive Collected DataEvidence2

Victims receive an archive with an executable and DLL... Attackers have used... ZIP archives... In one campaign... led recipients to attacker-controlled ZIP downloads.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation C2 Application Layer Protocol: Web T1071.001 HTTPS to asmweosiqsaaw[.]com

T1102Web ServiceEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation C2 Web Service T1102 Cloudflare-proxied C2

T1105Ingress Tool TransferEvidence7

Cruciferra has the option of either dropping the payload to disk or downloading a payload from a staging server.

Exfiltration

2 techniques

T1041Exfiltration Over C2 ChannelEvidence1

MITRE ATT&CK Mapping Tactic Technique ID Implementation Exfiltration Exfiltration Over C2 Channel T1041 Via zgRAT C2 protocol

T1567Exfiltration Over Web ServiceEvidence1

Discord's permanent file hosting capabilities have frequently been misused to distribute malware and exfiltrate data gathered from compromised systems using webhooks.

INDICATORS OF COMPROMISE

IOCs tracked for this family

54 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

34 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

11 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

9 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app12 days ago

ip.v4●●●●●●●●●●●●View more in app20 days ago

domain●●●●●●●●●●●●View more in app20 days ago

hash.sha256●●●●●●●●●●●●View more in app20 days ago

domain●●●●●●●●●●●●View more in app20 days ago

ACTIVITY FEED

Recent activity

15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

15 SOURCESView more in app

security affairsNews

Jul 28, 2026

New Crypter-as-a-Service Cruciferra Fuels Stealthy Malware Attacks Worldwide

Remote access trojan delivered via a Cruciferra-enabled campaign targeting hotels and travel companies.

the hacker newsNews

Jul 27, 2026

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

Remote access trojan delivered in campaigns using Cruciferra.

netresec blogNews

Jul 27, 2026

PureLogs, PureRAT and misleading zgRAT

A misleading and inconsistently used malware label in this reference, applied ambiguously to both PureLogs and PureRAT rather than a clearly defined single malware family.

cyber security newsNews

Jul 21, 2026

This $2,000-a-Month Crypter Can Kill EDR and Make Malware Disappear From Disk

A remote-access trojan delivered as a payload by Cruciferra in observed campaigns.

+11 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching54

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping23

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

zgRAT