From SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz . UPDATE: I will keep these here in case but it does use certificate pinning likely making these unusable and having to fallback on encrypted traffic analytics (beaconing/tunnels, fingerprinting etc.)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Initial C2 Registration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/auth”; endswith; http.request_body; content:“|7B 22|machine_id|22 3A 22|”; startswith; content:“|22 2C 22|version|22 3A 22|”; distance:0; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198001; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT User-Agent”; flow:established,to_server; http.user_agent; content:“CommandExecutor/”; startswith; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198002; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT System Info Exfiltration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/systeminfo”; endswith; http.request_body; content:“|7B 22|systeminfo|22 3A 22|”; startswith; content:“|22 2C 22|encrypted|22 3A|true|7D|”; distance:0; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198003; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT AV/EDR Info Exfiltration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/av_edr”; endswith; http.request_body; content:“|22 2C 22|encrypted|22 3A|true|7D|”; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198004; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Heartbeat and SOCKS Initiator”; flow:established,to_server; http.method; content:“GET”; http.uri; content:“/api/poll?machine_id=”; startswith; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198005; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Command Request”; flow:established,to_server; http.method; content:“GET”; http.uri; content:“/api/command/get”; endswith; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198006; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Command Result Exfiltration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/command/result”; endswith; http.request_body; content:“|7B 22|id|22 3A|”; startswith; content:“|2C 22|status|22 3A 22|”; distance:0; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198007; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT SOCKS Proxy ACK”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/proxy/ack”; endswith; http.request_body; content:“|7B 22|request_id|22 3A 22|”; startswith; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198008; rev:1;)