alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE DNSTrojan FakeAV Dropper Activity Observed (1)"; flow:established,to_server; http.uri; content:"v="; nocase; content:"&step="; nocase; content:"&hostid="; nocase; reference:url,www.abuse.ch/?p=2796; reference:url,www.abuse.ch/?p=2740; reference:md5,c59cdd1366dd5c2f448c03738ec0dc88; reference:md5,b93360ec3798215a5cca573747df0139; classtype:trojan-activity; sid:2011577; rev:5; metadata:created_at 2010_09_27, signature_severity Major, updated_at 2020_09_11;)