alert http $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET MALWARE Trojan.Win32.FraudPack.aweo"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"update.php?do="; fast_pattern; content:"&coid="; content:"&IP="; content:"&fff="; content:"&lct="; content:"&ttt="; content:"&v="; reference:md5,4bc4c32a8d93c29b026bbfb24ccecd14; classtype:trojan-activity; sid:2011294; rev:4; metadata:created_at 2010_09_28, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_10;)