alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET ADWARE_PUP Spyware.Agent.elbb lava.cn Game Exe Download"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"/LavaGame_"; nocase; content:".exe"; nocase; reference:url,securelist.com/en/descriptions/17601150/Trojan-Dropper.Win32.Agent.elbb?print_mode=1; reference:md5,c2b4f8abc742bf048f3856525c1b2800; reference:md5,4937dc6e111996dbe331327e7e9a4a12; reference:url,www.amada.abuse.ch/?search=download.lava.cn; classtype:pup-activity; sid:2014059; rev:9; metadata:attack_target Client_Endpoint, created_at 2012_01_02, deployment Perimeter, deprecation_reason Age, performance_impact Low, signature_severity Minor, updated_at 2023_05_16;)