# SIGS: SloppyRAT **URL:** \ **Category:** Rule Signatures\ **Created:** [September 10, 2026, 3:37pm UTC](https://community.emergingthreats.net/t/sigs-sloppyrat/3451 "2026-09-10T15:37:04Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\ **Post date:** [September 10, 2026, 3:37pm UTC](https://community.emergingthreats.net/t/sigs-sloppyrat/3451/1 "2026-09-10T15:37:04Z")
From [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](https://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) . UPDATE: I will keep these here in case but it does use certificate pinning likely making these unusable and having to fallback on encrypted traffic analytics (beaconing/tunnels, fingerprinting etc.) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT Initial C2 Registration”; flow:established,to\_server; http.method; content:“POST”; http.uri; content:“/api/auth”; endswith; http.request\_body; content:“|7B 22|machine\_id|22 3A 22|”; startswith; content:“|22 2C 22|version|22 3A 22|”; distance:0; fast\_pattern; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198001; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT User-Agent”; flow:established,to\_server; http.user\_agent; content:“CommandExecutor/”; startswith; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198002; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT System Info Exfiltration”; flow:established,to\_server; http.method; content:“POST”; http.uri; content:“/api/systeminfo”; endswith; http.request\_body; content:“|7B 22|systeminfo|22 3A 22|”; startswith; content:“|22 2C 22|encrypted|22 3A|true|7D|”; distance:0; fast\_pattern; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198003; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT AV/EDR Info Exfiltration”; flow:established,to\_server; http.method; content:“POST”; http.uri; content:“/api/av\_edr”; endswith; http.request\_body; content:“|22 2C 22|encrypted|22 3A|true|7D|”; fast\_pattern; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198004; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT Heartbeat and SOCKS Initiator”; flow:established,to\_server; http.method; content:“GET”; http.uri; content:“/api/poll?machine\_id=”; startswith; fast\_pattern; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198005; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT Command Request”; flow:established,to\_server; http.method; content:“GET”; http.uri; content:“/api/command/get”; endswith; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198006; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT Command Result Exfiltration”; flow:established,to\_server; http.method; content:“POST”; http.uri; content:“/api/command/result”; endswith; http.request\_body; content:“|7B 22|id|22 3A|”; startswith; content:“|2C 22|status|22 3A 22|”; distance:0; fast\_pattern; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198007; rev:1;) alert http $HOME\_NET any → $EXTERNAL\_NET any (msg:“ET TROJAN SloppyRAT SOCKS Proxy ACK”; flow:established,to\_server; http.method; content:“POST”; http.uri; content:“/api/proxy/ack”; endswith; http.request\_body; content:“|7B 22|request\_id|22 3A 22|”; startswith; fast\_pattern; classtype:trojan-activity; reference:url, [SloppyRAT: A New Tool For Ransomware Attacks | ThreatLabz](http://www.zscaler.com/blogs/security-research/sloppyrat-new-tool-ransomware-attacks) ; sid:198008; rev:1;) ---
**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\ **Post date:** [September 18, 2026, 4:35pm UTC](https://community.emergingthreats.net/t/sigs-sloppyrat/3451/2 "2026-09-18T16:35:01Z")
Hey @kevross33 Thanks for sharing! I checked and we have some signatures that cover the logic in this blog. We have signatures that are OPEN and PRO but I’ll move everything to OPEN to make sure we have coverage for what you shared. ### Current Signatures ```auto ET MALWARE MakinoLoader CnC Checkin Attempt - 2068885 ET MALWARE MakinoLoader EDR Data Exfiltration Attempt - 2068891 ET MALWARE MakinoLoader Systeminfo Data Exfiltration Attempt - 2068892 ET MALWARE MakinoLoader Tasking Request - 2068886 ET MALWARE MakinoLoader User-Agent Observed (CommandExecutor/1.0) - 2068884 ETPRO MALWARE MakinoLoader CnC Checkin - 2868364 ETPRO MALWARE MakinoLoader CnC Checkin Response - 2868365 ETPRO MALWARE MakinoLoader Victim HeartBeat - 2868367 ETPRO MALWARE MakinoLoader Victim Send AV Details - 2868368 ETPRO MALWARE MakinoLoader Victim Send Sysinfo - 2868366 ``` Thanks! Isaac ---
**Author:** ![rgonzalez](https://avatars.discourse-cdn.com/v4/letter/r/bc79bd/32.png) [@rgonzalez](https://community.emergingthreats.net/u/rgonzalez)\ **Post date:** [September 21, 2026, 8:49pm UTC](https://community.emergingthreats.net/t/sigs-sloppyrat/3451/3 "2026-09-21T20:49:16Z")
Thanks @kevross33 @ishaughnessy !