Post #4244094
2026-07-30 15:00 UTC
Only 3 IOCs have been posted to ThreatFox for the confusing catch-all label zgRAT in the past 12 months. Let's clear up any issues and figure out what they actually are.
89.23.103.60:7001 is PureRAT
194.169.175.191:39002 is PureMiner (also tagged correctly as "PUREMINER" by Neiki 🎉 )
196.251.86.238:56001 is PureRAT
Replies (1)
-
@netresec@infosec.exchange 2026-07-30 15:05
FlowCarp classifies 79.110.49.15:39001 as PureMiner and the other ones as PureRAT or TLS, PureRAT. The TLS prefix means that PureRAT C2 traffic is encrypted using TLS. Some of the traffic sent to FlowCarp for 196.251.86.238:56001 used proper TLS, while other sessions used a defunct TLS implementation that FlowCarp identifies as just PureRAT.