alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Rimecud.B Activity"; flow:established,to_server; http.method; content:"POST"; nocase; http.uri; content:"&acc=ups"; content:"&nick="; content:"&botver=Beta&code="; fast_pattern; http.user_agent; content:"|3b 20|es-ES|3b|"; distance:39; http.request_body; content:"plist|3d 2d 2d 2d|"; depth:9; content:"Passwords"; distance:0; reference:md5,01dd7102b9d36ec8556eed2909b74f52; classtype:trojan-activity; sid:2012517; rev:3; metadata:created_at 2011_03_17, malware_family Win32_Rimecud_B, signature_severity Major, updated_at 2024_02_14;)