zoxPNG RAT

Hunt Hypothesis

This hunt targets adversaries utilizing the zoxPNG remote access trojan to establish persistent command and control channels within the Azure environment. Proactively hunting for this low-severity indicator is critical because early detection of its specific YARA signature can reveal stealthy reconnaissance activities before they escalate into significant data exfiltration events.

YARA Rule

rule zoxPNG_RAT
{
    meta:
        Author      = "Novetta Advanced Research Group"
        Date        = "2014/11/14"
        Description = "ZoxPNG RAT, url inside"
        Reference   = "http://www.novetta.com/wp-content/uploads/2014/11/ZoxPNG.pdf"

    strings: 
        $url = "png&w=800&h=600&ei=CnJcUcSBL4rFkQX444HYCw&zoom=1&ved=1t:3588,r:1,s:0,i:92&iact=rc&dur=368&page=1&tbnh=184&tbnw=259&start=0&ndsp=20&tx=114&ty=58"

    condition: 
        $url
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the zoxPNG RAT detection rule in an enterprise environment, along with suggested filters and exclusions:

• Software Deployment via SCCM/Intune

  • Scenario: The IT Operations team deploys a new version of image editing software (e.g., Adobe Photoshop or GIMP) to 50+ endpoints using Microsoft Endpoint Configuration Manager (SCCM). The deployment package includes a custom PNG icon that matches the zoxPNG_RAT YARA signature, triggering alerts on every machine during the installation window.
  • Filter/Exclusion: Create an exclusion based on the Process Command Line containing specific deployment identifiers (e.g., ccmexec.exe or msiexec.exe) and restrict the alert to the known software vendor’s hash list. Alternatively, exclude alerts originating from the specific SCCM distribution point IP range during scheduled maintenance windows.

• Automated Log Analysis with Python Scripts

  • Scenario: A Data Engineering team runs a nightly scheduled job using a Python script (python.exe) that parses server logs stored in PNG format (e.g., QR code snapshots of system health). The script reads these files into memory, causing the YARA rule to flag the python.exe process as suspicious activity because it is handling a file matching the RAT signature.
  • Filter/Exclusion: Implement a filter that excludes alerts where the Parent Process is taskeng.exe (Windows Task Scheduler) and the Process Name is python.exe. Additionally, whitelist the specific directory path where these log images are stored (e.g., C:\Data\Logs\HealthChecks) to prevent file-based triggers.

• Digital Asset Management (DAM) Indexing

  • Scenario: The Marketing department utilizes a Digital Asset Management tool like Bynder or Adobe Experience Manager.