# Signature: ET TROJAN Possible HijackLoader Second Stage PNG

**URL:** <https://community.emergingthreats.net/t/signature-et-trojan-possible-hijackloader-second-stage-png/1472>\
**Category:** Rule Signatures\
**Created:** [March 19, 2024, 3:44pm UTC](https://community.emergingthreats.net/t/signature-et-trojan-possible-hijackloader-second-stage-png/1472 "2024-03-19T15:44:06Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [March 21, 2024, 9:18am UTC](https://community.emergingthreats.net/t/signature-et-trojan-possible-hijackloader-second-stage-png/1472/4 "2024-03-21T09:18:40Z")

</div>

It may be possible to use IDAT|C6 A5 79 EA| as the string because that appears in the recent crowdstrike article and also the morphisec article too. There may be other magic byte sequences but having this may result in a lower FP rate if we coudl try that?

---

_[View the full topic](https://community.emergingthreats.net/t/signature-et-trojan-possible-hijackloader-second-stage-png/1472)._