alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.HLLW.Autoruner USA_Load UA"; flow:established,to_server; http.user_agent; content:"USA_Load"; depth:8; reference:url,news.drweb.com/show/?i=2440&lng=en&c=5; classtype:trojan-activity; sid:2014752; rev:4; metadata:created_at 2012_05_17, signature_severity Major, updated_at 2020_05_08;)