alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Ponmocup.A Checkin"; flow:established,to_server; urilen:10; http.method; content:"GET"; http.uri; content:"/space.php"; fast_pattern; http.accept; bsize:3; content:"*/*"; http.cookie; content:"uid="; startswith; content:"|3b 20|VISITOR="; distance:0; http.header_names; content:"|0d 0a|Accept|0d 0a|Cookie|0d 0a|"; content:"|0d 0a|User-Agent|0d 0a|"; distance:-2; content:"|0d 0a|Host|0d 0a|"; distance:-2; reference:md5,97a1acc085849c0b9af19adcf44607a7; classtype:command-and-control; sid:2014660; rev:6; metadata:created_at 2012_05_01, malware_family Win32_Ponmocup_A, signature_severity Major, updated_at 2024_03_12;)