# SIG: ET MALWARE MintsLoader CnC Activity (GET) M2

**URL:** <https://community.emergingthreats.net/t/sig-et-malware-mintsloader-cnc-activity-get-m2/2768>\
**Category:** Rule Signatures\
**Created:** [May 27, 2025, 11:41am UTC](https://community.emergingthreats.net/t/sig-et-malware-mintsloader-cnc-activity-get-m2/2768 "2025-05-27T11:41:22Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [May 27, 2025, 11:41am UTC](https://community.emergingthreats.net/t/sig-et-malware-mintsloader-cnc-activity-get-m2/2768/1 "2025-05-27T11:41:22Z")

</div>

Hi, The existing MintsLoader sigs don’t detect these more recent MD5s (available on tria.ge). [1:2057741:2] ET MALWARE TA582 CnC Checkin does but it is also dependent on the DGA remaining using .top domains and not changing so this is another detection.

alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET MALWARE MintsLoader CnC Activity (GET) M2”; flow:established,to\_server; http.method; content:“GET”; nocase; http.uri; content:“.php?id=”; content:“&key=”; distance:0; content:“&s=”; distance:0; pcre:“/&key=\d{11,12}&s=/”; http.user\_agent; content:“WindowsPowerShell/”; nocase; classtype:trojan-activity; reference:url,[go.recordedfuture.com/hubfs/reports/cta-2025-0429.pdf](http://go.recordedfuture.com/hubfs/reports/cta-2025-0429.pdf); reference:md5,dc9c6e67b962077810aa1363ccf371bc; reference:md5,555176dda034be756720e0b60f753da4; sid:165001; rev:1;)

Kind Regards,  
Kevin Ross