# LgoogLoader, PikaBot, RedLine rules **URL:** \ **Category:** Rule Signatures\ **Created:** [May 30, 2023, 12:46pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597 "2023-05-30T12:46:09Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [May 30, 2023, 12:46pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/1 "2023-05-30T12:46:09Z")
Hi, today I have three rules in the ET open set. The first to load the encrypted configuration of the LgoogLoader. ```auto alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] LgoogLoader";flow: established, to_server; http.method;content: "HEAD"; http.uri;content: ".CfgEncFile"; endswith; http.header;content: "Content-Length: 0"; http.user_agent; content: "Chrome"; bsize: 6; content:!"Referer|0d 0a|"; reference:md5,69525fa93fd47eb3c533afe3b1baba48; classtype: trojan-activity;sid: 1; rev: 1;) ``` The second rule is for the PikaBot loader and its requests for loading a DLL using a PowerShell script. ```auto alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] PikaBot";flow: established, to_server; http.method;content: "GET"; http.uri;pcre: "/^\/[a-zA-Z0-9]{1,8}(([0-9][A-Za-z])|([a-z][\dA-Z])|([A-Z][\da-z])|([a-z]\d[\da-z]))[a-zA-Z0-9]{0,8}\/[a-zA-Z0-9]{1,8}(([0-9][A-Za-z])|([a-z][\dA-Z])|([A-Z][\da-z])|([a-z]\d[\da-z]))[a-zA-Z0-9]{0,8}$/";http.host;pcre: "/^(?:(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])\.){3}(?:\d|[1-9]\d|1\d\d|2[0-4]\d|25[0-5])(:\d{2,5})?$/R";http.user_agent;content: "WindowsPowerShell"; http.header_names;content: "|0d0a|User-Agent|0d 0a|Host|0d 0a|Connection|0d 0a 0d 0a|";startswith; reference:md5,26c1f8c5631a5b633c324e7986dc7054; classtype: trojan-activity;sid: 2; rev: 1;) ``` And the third rule on the Redline stealer on the [MC-NMF] .NET Message Framing Protocol for authorization. ```auto alert tcp any any -> any any (msg: "ET MALWARE [ANY.RUN] RedLine (MC-NMF Authorization)";flow: established, to_server;stream_size: server, =, 2;content: "|020B0173040B0161065608440A1E0082AB01400D|Authorization|0803|ns1|9920|"; classtype: trojan-activity; reference:md5,dda288278d0023242afff00556d97d60; sid: 3; rev: 1;) ``` Unfortunately, I cannot post more than two links, so I am attaching a link to the github. > Tweet about it:) > I wish you a good day and I’m glad to help make the world a little bit safer place, even if only in cyberspace! Regards, Jane. ---
**Author:** ![samjenk](https://avatars.discourse-cdn.com/v4/letter/s/85e7bf/32.png) [@samjenk](https://community.emergingthreats.net/u/samjenk)\ **Post date:** [May 30, 2023, 1:21pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/2 "2023-05-30T13:21:47Z")
As a consumer of ET Open, I appreciate how you and others make your discoveries available for our use. Thank you, @Jane0sint! ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [May 31, 2023, 11:37am UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/3 "2023-05-31T11:37:29Z")
Thanks Jane! These are great, will take a look and see about getting them out today. Thank you! JT ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [May 31, 2023, 3:01pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/4 "2023-05-31T15:01:26Z")
I wanted to share how I was looking for a loader - through sandbox search: [https://www.joesandbox.com/search?q=LgoogLoader](https://www.joesandbox.com/search?q=LgoogLoader) In all samples, the CfgEncFile URI in memory dump. Sometimes I make mistakes in sample attribution ¯\**(ツ)**/¯ who doesn’t make mistakes? ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [May 31, 2023, 11:24pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/5 "2023-05-31T23:24:41Z")
Yeah not a big deal on naming, easy enough to change if we need to, naming updates happen quite frequently. The remaining two signatures should go out tomorrow (Thursday). It took a little while to go through samples and such so we didn’t get them all out today. Thank you again for the submissions, good stuff! JT ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [June 2, 2023, 3:22pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/6 "2023-06-02T15:22:15Z")
One more follow-up. The new signatures are : 2045974 - ET MALWARE [ANY.RUN] LgoogLoader Retrieving Config File 2046045 - ET MALWARE [ANY.RUN] RedLine Stealer Related (MC-NMF Authorization) 2046046 - ET MALWARE [ANY.RUN] PikaBot Related Activity (GET) The existing signature for connection initialization we moved from MALWARE to INFO due to the net.tcp connection being a standard library and not by itself indicative of MALWARE but of course is of interest. There are a number of follow on signatures that alert more specifically on the Redline exfil contents. Was: 2043233 - ET MALWARE RedLine Stealer TCP CnC net.tcp Init Now: 2043233 - ET INFO Microsoft net.tcp Connection Initialization Activity JT ---
**Author:** ![Jane0sint](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jane0sint/32/398_2.png) [@Jane0sint](https://community.emergingthreats.net/u/Jane0sint)\ **Post date:** [December 28, 2023, 9:48am UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/7 "2023-12-28T09:48:31Z")
Hi, can I ask you to add a link to this discussion in the rules 2045974 2046045 2046046? reference:url,[community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules](http://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules) ---
**Author:** ![jtaylor](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jtaylor/32/12_2.png) [@jtaylor](https://community.emergingthreats.net/u/jtaylor)\ **Post date:** [December 28, 2023, 7:04pm UTC](https://community.emergingthreats.net/t/lgoogloader-pikabot-redline-rules/597/8 "2023-12-28T19:04:07Z")
Updated signatures will go out today! JT