SIGS: SloppyRAT

Rule Signatures
1

From SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz . UPDATE: I will keep these here in case but it does use certificate pinning likely making these unusable and having to fallback on encrypted traffic analytics (beaconing/tunnels, fingerprinting etc.)

alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Initial C2 Registration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/auth”; endswith; http.request_body; content:“|7B 22|machine_id|22 3A 22|”; startswith; content:“|22 2C 22|version|22 3A 22|”; distance:0; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198001; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT User-Agent”; flow:established,to_server; http.user_agent; content:“CommandExecutor/”; startswith; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198002; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT System Info Exfiltration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/systeminfo”; endswith; http.request_body; content:“|7B 22|systeminfo|22 3A 22|”; startswith; content:“|22 2C 22|encrypted|22 3A|true|7D|”; distance:0; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198003; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT AV/EDR Info Exfiltration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/av_edr”; endswith; http.request_body; content:“|22 2C 22|encrypted|22 3A|true|7D|”; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198004; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Heartbeat and SOCKS Initiator”; flow:established,to_server; http.method; content:“GET”; http.uri; content:“/api/poll?machine_id=”; startswith; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198005; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Command Request”; flow:established,to_server; http.method; content:“GET”; http.uri; content:“/api/command/get”; endswith; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198006; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT Command Result Exfiltration”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/command/result”; endswith; http.request_body; content:“|7B 22|id|22 3A|”; startswith; content:“|2C 22|status|22 3A 22|”; distance:0; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198007; rev:1;)
alert http $HOME_NET any → $EXTERNAL_NET any (msg:“ET TROJAN SloppyRAT SOCKS Proxy ACK”; flow:established,to_server; http.method; content:“POST”; http.uri; content:“/api/proxy/ack”; endswith; http.request_body; content:“|7B 22|request_id|22 3A 22|”; startswith; fast_pattern; classtype:trojan-activity; reference:url, SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz ; sid:198008; rev:1;)

1 Like
2

Hey @kevross33

Thanks for sharing! I checked and we have some signatures that cover the logic in this blog. We have signatures that are OPEN and PRO but I’ll move everything to OPEN to make sure we have coverage for what you shared.

Current Signatures

ET MALWARE MakinoLoader CnC Checkin Attempt - 2068885
ET MALWARE MakinoLoader EDR Data Exfiltration Attempt - 2068891
ET MALWARE MakinoLoader Systeminfo Data Exfiltration Attempt - 2068892
ET MALWARE MakinoLoader Tasking Request - 2068886
ET MALWARE MakinoLoader User-Agent Observed (CommandExecutor/1.0) - 2068884
ETPRO MALWARE MakinoLoader CnC Checkin - 2868364
ETPRO MALWARE MakinoLoader CnC Checkin Response - 2868365
ETPRO MALWARE MakinoLoader Victim HeartBeat - 2868367
ETPRO MALWARE MakinoLoader Victim Send AV Details - 2868368
ETPRO MALWARE MakinoLoader Victim Send Sysinfo - 2868366

Thanks!
Isaac

2 Likes
3

Thanks @kevross33 @ishaughnessy !