# SIG: ET TROJAN Interlock.RansomGroup RAT Initial Callback

**URL:** <https://community.emergingthreats.net/t/sig-et-trojan-interlock-ransomgroup-rat-initial-callback/2652>\
**Category:** Rule Signatures\
**Created:** [April 22, 2025, 11:17am UTC](https://community.emergingthreats.net/t/sig-et-trojan-interlock-ransomgroup-rat-initial-callback/2652 "2025-04-22T11:17:08Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [April 22, 2025, 11:17am UTC](https://community.emergingthreats.net/t/sig-et-trojan-interlock-ransomgroup-rat-initial-callback/2652/1 "2025-04-22T11:17:09Z")

</div>

Tested against PCAP from tria.ge for SHA256 299a8ef490076664675e3b52d6767bf89ddfa6accf291818c537a600a96290d2 where it is magic bytes and then the fields [Interlock ransomware evolving under the radar - Sekoia.io Blog](http://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/). While the report also notes it is on TCP 443 it uses as a RAT it should be able to use any port so I have not limited the rule to that.

alert tcp $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN Interlock.RansomGroup RAT Initial Callback “; flow:established,to\_server; content:”|55 11 69 DF|{|22|iptarget|22|”; depth:15; content:“|22|domain|22|”; distance:0; classtype:trojan-activity; reference:url,[Interlock ransomware evolving under the radar - Sekoia.io Blog](http://blog.sekoia.io/interlock-ransomware-evolving-under-the-radar/); reference:md5,2366128c20f42ee819251747eb3199a4; sid:123451; rev:1;)

Kind Regards,  
Kevin Ross

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [April 22, 2025, 8:23pm UTC](https://community.emergingthreats.net/t/sig-et-trojan-interlock-ransomgroup-rat-initial-callback/2652/2 "2025-04-22T20:23:46Z")

</div>

Hey @kevross33 - As always, thanks for the great content! We got this signature in today’s release as `2061804 - ET MALWARE Interlock RAT CnC Checkin`.

Thanks!  
Isaac