# ET MALWARE JavaScript Loader Associated With Interlock Ransomware

**URL:** <https://community.emergingthreats.net/t/et-malware-javascript-loader-associated-with-interlock-ransomware/2726>\
**Category:** Rule Signatures\
**Created:** [May 12, 2025, 9:55am UTC](https://community.emergingthreats.net/t/et-malware-javascript-loader-associated-with-interlock-ransomware/2726 "2025-05-12T09:55:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [May 12, 2025, 9:55am UTC](https://community.emergingthreats.net/t/et-malware-javascript-loader-associated-with-interlock-ransomware/2726/1 "2025-05-12T09:55:06Z")

</div>

Interlock ransomware linked loader (executes via node.exe downloaded nodeJS too instead of wscript) mentioned in Sekoia report. PCAP here [&nbsp;57eed5ac287a103b43007d27312fbdc6e70fe32b3e3dc3286847fdcf86330d33 | Triage](https://tria.ge/241106-b3b51starp/behavioral2). Looks to use various URLs, IPs and trycloudflare for this but appears to use HTTP for communication even to cloudflare rather than HTTPS (although no reason it couldn’t).

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MALWARE JavaScript Loader Associated With Interlock Ransomware”; flow:established,to\_server; content:“POST”; http\_method; urilen:9; content:“/init1234”; http\_uri; fast\_pattern:only; content:!"User-Agent|3A|; http\_header; content:!"Referer|3A|; http\_header; content:“Content-Type|3A| application/octet-stream”; http\_header; classtype:trojan-activity; reference:url,[Interlock ransomware evolving under the radar - Sekoia.io Blog](http://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/); sid:149050; rev:1;)

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [May 12, 2025, 3:51pm UTC](https://community.emergingthreats.net/t/et-malware-javascript-loader-associated-with-interlock-ransomware/2726/2 "2025-05-12T15:51:16Z")

</div>

Hey @kevross33 - It looks like we got a sig out last week that will detect the CnC traffic in this blog.

As always thanks for the submission and taking the time to share intel! Here’s the sid if you’re curious:

```auto
ET MALWARE Interlock Ransomware Fake Updater CnC Callback - 2062145

```

Thanks!  
Isaac