# PrivateLoader Signature

**URL:** https://community.emergingthreats.net/t/privateloader-signature/1650
**Category:** Rule Signatures
**Created:** [May 18, 2024, 3:14pm UTC](https://community.emergingthreats.net/t/privateloader-signature/1650 "2024-05-18T15:14:51Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![jt42](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/jt42/32/1046_2.png) [@jt42](https://community.emergingthreats.net/u/jt42)
#### Post date: [May 18, 2024, 3:14pm UTC](https://community.emergingthreats.net/t/privateloader-signature/1650/1 "2024-05-18T15:14:51Z")

</div>

It looks like the POST is covered by 2049837 but the GET seems unique enough it might do okay too.

`alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Private Loader Related Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/b"; startswith; fast_pattern; content:".php"; endswith; http.host; pcre:"/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/"; http.user_agent; content:!"Linux"; http.header_names; content:"|0d 0a|Connection|0d 0a|"; startswith; content:!"Referer|0d 0a|"; reference:md5,362697c95a1c9964af1ab23ddfc29b04; classtype:trojan-activity; sid:1; rev:1;) `

sandbox: [privateloader |&nbsp;ecfe6fb22dff160829a258b0dc35703846e8eb30bc16e1ce549321736b89b448 | Triage](https://tria.ge/240516-c7fjnsgh3y/behavioral1)

---

<div class="post-metadata">

### Author: ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)
#### Post date: [May 20, 2024, 9:14pm UTC](https://community.emergingthreats.net/t/privateloader-signature/1650/2 "2024-05-20T21:14:18Z")

</div>

thanks for the tip @jt42 ! Here’s the sid that went out today.

` 2052789 - ET MALWARE Private Loader Related Activity (GET)`

---

<div class="post-metadata">

### Author: ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)
#### Post date: [May 20, 2024, 9:25pm UTC](https://community.emergingthreats.net/t/privateloader-signature/1650/3 "2024-05-20T21:25:06Z")

</div>

Thanks @jt42 @ishaughnessy !