# SIG: ET MALWARE APT28.Russia Macro Loader HTTP POST

**URL:** <https://community.emergingthreats.net/t/sig-et-malware-apt28-russia-macro-loader-http-post/2755>\
**Category:** Rule Signatures\
**Created:** [May 22, 2025, 3:35pm UTC](https://community.emergingthreats.net/t/sig-et-malware-apt28-russia-macro-loader-http-post/2755 "2025-05-22T15:35:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [May 22, 2025, 3:35pm UTC](https://community.emergingthreats.net/t/sig-et-malware-apt28-russia-macro-loader-http-post/2755/1 "2025-05-22T15:35:21Z")

</div>

Page 8 in reference is screenshot of the packet, does not open with JSON in body. Seems to replace HATVIBE.loader to then deploy subsequent payloads such as CHERRYSPY

alert tcp $HOME\_NET any → $EXTERNAL\_NET $HTTP\_PORTS (msg:“ET MALWARE APT28 Russia Macro Loader HTTP POST”; flow:established,to\_server; content:“POST”; http\_method; content:“{|22|compname|22 3A 22|”; http\_client\_body; content:“|22|username|22 3A 22|”; http\_client\_body; distance:0; content:“|22|region|22 3A 22|”; http\_client\_body; distance:0; content:“|22|resolution|22 3A 22|”; http\_client\_body; distance:0; content:“|22|language|22 3A 22|”; http\_client\_body; distance:0; content:“|22|system|22 3A 22|”; http\_client\_body; distance:0; classtype:trojan-activity; reference:url,[go.recordedfuture.com/hubfs/reports/cta-2025-0522.pdf](http://go.recordedfuture.com/hubfs/reports/cta-2025-0522.pdf); reference:md5,919d1c4abd151525ec71d431f781306c; sid:199001; rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![trobinson667](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/trobinson667/32/544_2.png) [@trobinson667](https://community.emergingthreats.net/u/trobinson667)\
**Post date:** [May 22, 2025, 6:29pm UTC](https://community.emergingthreats.net/t/sig-et-malware-apt28-russia-macro-loader-http-post/2755/2 "2025-05-22T18:29:44Z")

</div>

Hey Kevin,

We’re always happy to see your contributions to the ruleset. I made a couple of very minor modifications:

1. set `|22|compname|22 3a 22|` as the `fast_pattern`. Seemed the most unique out of the choices available
2. removed the `{` from the `compname` content match.
3. removed `distance:0` from the other content matches

Why did I do 2 and 3? I’d like to account for situations in which the parameter order is changed. The rule might not perform quite as well, but perhaps it might result in catching a slightly wider net. Here are the rules I’ll be submitting, based on your submission:

```auto
snort:
alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:“ET MALWARE APT28 Russia Macro Loader HTTP POST”; flow:established,to_server; content:“POST”; http_method; content:“|22|compname|22 3A 22|”; fast_pattern; http_client_body; content:“|22|username|22 3A 22|”; http_client_body; content:“|22|region|22 3A 22|”; http_client_body; content:“|22|resolution|22 3A 22|”; http_client_body; content:“|22|language|22 3A 22|”; http_client_body; content:“|22|system|22 3A 22|”; http_client_body; classtype:trojan-activity; reference:url,go.recordedfuture.com/hubfs/reports/cta-2025-0522.pdf; reference:md5,919d1c4abd151525ec71d431f781306c; sid:199001; rev:1;)

suricata:
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:“ET MALWARE APT28 Russia Macro Loader HTTP POST”; flow:established,to_server; http.method; content:"POST"; http.request_body; content:“|22|compname|22 3A 22|”; fast_pattern; content:“|22|username|22 3A 22|”; content:“|22|region|22 3A 22|”; content:“|22|resolution|22 3A 22|”; content:“|22|language|22 3A 22|”; content:“|22|system|22 3A 22|”; classtype:trojan-activity; reference:url,go.recordedfuture.com/hubfs/reports/cta-2025-0522.pdf; reference:md5,919d1c4abd151525ec71d431f781306c; sid:199001; rev:1;)

```

Expect this rule to be out with the daily rule update today.

Thanks,

-Tony