zgRATMalware
zgRAT is a Remote Access Trojan malware which sometimes drops other malware such as AgentTesla malware. zgRAT has an inforstealer use which targets browser information and cryptowallets. Usually spreads by USB or phishing emails with -zip/-lnk/.bat/.xlsx attachments and so on.From MISP Galaxy
Last reported 3 months ago, by Infosecurity Magazine2 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1055.012Process Hollowing
“PluginExecuting: Downloading and executing files, updating, uninstalling, in-memory execution (process hollowing/injection).”
- T1056.001Keylogging
“Its capabilities include remote user interface access (VNC-like), mouse and keyboard control, webcam and microphone capture, keylogging, file upload/download, traffic proxying, data exfiltration, and remote execution of commands or binaries.”
- T1555.005Password Managers
“Targeted theft modules: Collection of extensions, wallets, password managers, and 2FA authenticators (scanning known paths/applications).”
- T1684Social Engineering
“The email included a URL that ultimately led to the compromise of the victim machine through the ClickFix social engineering tactic.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Cruciferra Crypter Uses Process Ghosting to Evade Detection“… Administration to deliver XWorm, and a late-June operation used bed-bug guest-complaint lures against hospitality organizations to drop zgRAT.”
-
Booking.com Phishing Campaign Targeting Hotels and Customers“In addition to PureRAT, PureCoder offers other malware, notably the stealer PureLogs (aka zgRAT) and the crypter PureCrypter, both documented during a campaign targeting MSSQL honeypots.”
Indicators in its reports
named in the reports above- exploit[.]inin 1 report
- rule[.]inin 1 report
- process[.]pidin 1 report
- action.properties[.]companyin 1 report
- d4845669f7f56c6c4eb82147a1f82615in 1 report
- 9bab404584f6a0d9…132fd145dd32in 1 report
- 799e73863806df2964d80d12ce4e61eain 1 report
- headkickscountry[.]comin 1 report
- activatecapagm[.]comin 1 report
- homelycareinc[.]comin 1 report
- byliljedahl[.]comin 1 report
- jamerimprovementsllc[.]comin 1 report
- seedsuccesspath[.]comin 1 report
- zenavuurwerkofficial[.]comin 1 report
- brownsugarcheesecakebar[.]comin 1 report
- hareandhosta[.]comin 1 report
- customvanityco[.]comin 1 report
- ctrlcapaserc[.]comin 1 report
- bknqsercise[.]comin 1 report
- bkngssercise[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.