alert http $EXTERNAL_NET $HTTP_PORTS -> $HOME_NET any (msg:"ET DELETED Trojan-Spy.Win32.Bancos Download"; flow:established,from_server; content:"[AspackDie!]"; content:"|0f 6d 07 9e 6c 62 6c 68 00 d2 2f 63 6d 64 9d 11 af af 45 c7 72 ac 5f 3138 d0|"; reference:url,securityresponse.symantec.com/avcenter/venc/data/pwsteal.bancos.b.html; classtype:trojan-activity; sid:2001726; rev:10; metadata:created_at 2010_07_30, malware_family Bancos, signature_severity Unknown, tag Banking_Trojan, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2019_07_26;)