PureLogs, PureRAT and misleading zgRAT

Please stop classifying malware as zgRAT. That malware label is confusing. As far as I know, there isn’t a proper definition of what zgRAT actually is. Some claim that zgRAT is the same malware family as PureLogs, while others argue that zgRAT should be mapped to PureRAT. There is also a blog post by malware analysts khr0x and Jane where they clearly state that PureLogs is not the same thing as zgRAT.

Despite the similar names PureLogs and PureRAT are not the same type of malware. PureLogs is an infostealer, while PureRAT is a Remote Access Trojan (RAT). Both are, however, built using .NET and are developed by PureCoder.

We previously helped clear up confusion around labels like ResolverRAT and PureHVNC, which were used in the past to refer to PureRAT malware samples. We hope this post helps reduce misunderstandings caused by the use of zgRAT.

Naming malware and threat actors

Malware labels and threat-actor labels serve different purposes. Publicly attributing an attack to a real-world organization might cause political turmoil, which can be avoided by using a threat-actor alias instead. Threat-actor aliases also often reflect each organization’s access to evidence and internal clustering process. As a result, multiple aliases for the same actor can coexist.

Malware-family labels, on the other hand, are usually more deterministic. Given a hash of a malware sample, researchers generally know they’re looking at the exact same artifact. For that reason, the most useful practice is to use the same name as the malware developers or the earliest widely adopted naming and use “unknown” or “unidentified” when classification is unclear. This reduces label fragmentation and downstream confusion when the same label is reused for different malware families.

Why zgRAT causes confusion

Many zgRAT signatures consistently match PureLogs, while others match PureRAT. There’s also a fairly popular YARA rule called “MALWARE_Win_zgRAT” that matches pretty much any binary protected with .NET Reactor. Taken together, this creates a solid foundation for false positives and misunderstandings stemming from the zgRAT label. And without a proper definition of what zgRAT actually is, such as a consistent mapping to a single malware family, false positives and misclassifications involving the zgRAT label are much harder to spot and weed out.

PureLogs

PureLogs is an infostealer that automatically collects and exfiltrates credentials and sensitive data from infected hosts, including browser-stored logins, credit card numbers, cookies, crypto-wallet data, VPN credentials and credentials for various chat/messaging platforms.

PureLogs uses a custom binary protocol to exfiltrate stolen data. As of PureLogs v5.0 the network traffic is often wrapped in TLS, thereby making it harder to detect on the network.

Default ports:

• TCP 7702 (non-TLS)
• TCP 8443 (TLS)

Server ports are configurable, but the default ports are often used.

Suricata signatures for non-TLS PureLogs traffic:

• 2048901 ET MALWARE [ANY.RUN] zgRAT / PureLogs Stealer C2 Connection M2
• 2061601 ET MALWARE zgRAT / PureLogs Stealer GZIP Exfiltration Outbound
• 2061633 ET MALWARE PureLogs Backdoor Server GZIP C2 Traffic
• 2061634 ET MALWARE PureLogs Backdoor Client GZIP C2 Traffic
• 2063215 ET MALWARE zgRAT / PureLogs Stealer C2 Server Connection M3

Suricata signatures for TLS encrypted PureLogs traffic:

• 903209166 SSLBL: Malicious SSL certificate detected (PureHVNC C&C)
• 903209246 SSLBL: Malicious SSL certificate detected (PureHVNC C&C)
• 903209570 SSLBL: Malicious SSL certificate detected (PureHVNC C&C)
• 903209620 SSLBL: Malicious SSL certificate detected (PureHVNC C&C)
• 903209854 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903210180 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)

FlowCarp protocol names:

• PureLogs
• TLS, PureLogs

Recent PureLogs examples:

• 404f0d36fcbe5c4643e821403a4827eb 204.44.93.88:8449
• 7e49bac468548a0e83133f0d5b02544b 5.101.84.75:4242
• 3c9852c53cb45221886b34ed6bc7d674 46.151.182.159:776

PureRAT

PureRAT is a Remote Access Trojan (RAT) with many built-in features for live interaction with infected hosts, such as:

• Hidden VNC (HVNC) and remote desktop with mouse and keyboard control
• Viewing the webcam
• Listening to the microphone
• Real-time keylogging
• Remote command prompt
• Reverse proxy (HTTP and SOCKS5)
• Code injection

PureRAT previously used a flawed TLS implementation that could be easily detected on the network. The current TLS implementation is much more difficult to spot.

Default C2 ports:

• TCP 56001
• TCP 56002
• TCP 56003

Server ports are configurable, but the default ports are often used.

Suricata signatures for PureRAT traffic:

• 2035595 ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
• 2070181 ET MALWARE PureRAT TLS Certificate Observed (PureRAT Agent)
• 903207457 SSLBL: Malicious SSL certificate detected (ResolverRAT C&C)
• 903207905 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903207907 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903207937 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903208736 SSLBL: Malicious SSL certificate detected (PureHVNC C&C)
• 903208901 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903209054 SSLBL: Malicious SSL certificate detected (ResolverRAT C&C)
• 903209136 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903209139 SSLBL: Malicious SSL certificate detected (PureLogsStealer C&C)
• 903209682 SSLBL: Malicious SSL certificate detected (ResolverRAT C&C)
• 906200096 SSLBL: Malicious JA3 SSL-Client Fingerprint detected (AsyncRAT)

FlowCarp protocol names:

• PureRAT
• TLS, PureRAT

PureRAT sample examples:

• 323fed78fc8aaa86c3d35aa85313645d 85.239.149.178:56001
• b4400998cf293b0767455fb37526b18e 196.251.107.6:56001
• 010301d23beacee631006245ed09a2f7 45.192.211.59:56001

Detection notes

As you can see, both PureLogs and PureRAT traffic can trigger Suricata alerts with signatures labeled as “zgRAT”. There are also still signatures using outdated names like “PureHVNC” and “ResolverRAT”. Luckily, analysts know that the alert label often doesn’t map to the correct malware family. The alert labels merely reflect how the rule author named the suspected malware at creation time. Nevertheless, the fact that the “zgRAT“ label is used for PureLogs as well as PureRAT signatures contributes to the confusion regarding what zgRAT actually is.

I use FlowCarp to identify PureLogs and PureRAT traffic and to tell them apart. FlowCarp uses statistical methods for identifying the C2 protocol, which allows it to identify PureLogs as well as PureRAT traffic without having to track every new X.509 certificate that the C2 servers use.

Recommendations

Given the fuzziness and ongoing confusion around the zgRAT label, I strongly recommend not using that term. If you know that a sample is a piece of malware created by PureCoder (including PureLogs, PureRAT, PureMiner or BlueLoader), but you don’t know which one, then label it “unknown PureCoder malware” instead of slapping the poorly defined zgRAT label to it.

Feel free to use the FlowCarp demo service if you have a PCAP file with C2 traffic and want a second opinion on the C2 protocol or malware family. You can use curl to submit a PCAP file to the FlowCarp demo service like this:

Posted by Erik Hjelmvik on Monday, 27 July 2026 16:00:00 (UTC/GMT)

Tags: #zgRAT​ #PureRAT​ #PureLogs​ #PureHVNC​ #ResolverRAT​ #Suricata​ #FlowCarp​