alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Dosenjo/Kvadr Proxy Trojan Activity"; flow:established,to_server; http.uri; content:"hingDeny="; nocase; content:"&id="; nocase; pcre:"/\?ca[sc]hingDeny=[0-9A-Za-z]{16}&/"; reference:url,www.f-secure.com/v-descs/trojan-proxy_w32_kvadr_gen!a.shtml; reference:md5,fd2d6bb1d2a9803c49f1e175d558a934; reference:md5,e4664144f8e95cfec510d5efa24a35e7; classtype:trojan-activity; sid:2010334; rev:6; metadata:created_at 2010_07_30, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_21;)