zgRAT

zgRAT is a Windows malware label used in the wild for payloads delivered in phishing and malware-delivery chains, but the name is inconsistently applied and does not map cleanly to a single, well-defined family. Security reporting has associated the label with malware distributed through loaders and crypters such as Cruciferra, DOILoader, Rhadamanthys, StealC, and CastleLoader, including campaigns targeting hospitality, travel, and other business sectors with social-engineering lures such as guest complaints, tax themes, and Booking.com impersonation. Observed delivery methods include phishing, ClickFix-style user execution, malicious archives, PowerShell-based staging, and DLL sideloading.

Attribution of capabilities under the zgRAT name is complicated by naming ambiguity. Some analysts map zgRAT to PureLogs, a .NET infostealer associated with theft of credentials, browser cookies, financial data, cryptocurrency-wallet data, VPN credentials, and other sensitive information, with exfiltration sometimes occurring over TLS and in some cases via Discord webhooks. Other analysts map zgRAT to PureRAT, a .NET remote-access trojan associated with Hidden VNC, remote desktop control, webcam and microphone access, keylogging, reverse proxying, code injection, and broader interactive post-compromise control. Because both PureLogs and PureRAT have been labeled zgRAT by different vendors and detections, the term is best treated as an ambiguous umbrella label rather than a deterministic family name.

High-confidence reporting shows that malware called zgRAT has been used in financially motivated intrusion activity and commonly appears alongside other commodity stealers and RATs. It has been observed in campaigns against hospitality and travel organizations, including operations using Booking.com-themed lures and DLL sideloading chains, and in other phishing campaigns where it followed loaders or stealers such as Rhadamanthys. The malware associated with this label is therefore linked at minimum to credential theft, session theft through browser-cookie collection, exfiltration, and in some cases broader remote-access and surveillance functions. Precise family classification should be made cautiously and, where possible, replaced with the more specific family names PureLogs or PureRAT when technical evidence supports that distinction.