alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Cridex.B/Feodo Checkin"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/in"; offset:11; depth:3; pcre:"/\/\w{3}\/\w\d_\w\w\w\/in\/?$/i"; http.host; content:".ru"; endswith; fast_pattern; reference:md5,7ed139b53e24e4385c4c59cd2aa0e5f7; reference:url,labs.m86security.com/2012/03/the-cridex-trojan-targets-137-financial-organizations-in-one-go/; reference:url,blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html; reference:url,about-threats.trendmicro.com/Malware.aspx?language=us&name=WORM_CRIDEX.IC; classtype:command-and-control; sid:2014405; rev:11; metadata:created_at 2012_02_29, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_02_14;)