alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Kazy/Kryptic Checkin with Opera/9 User-Agent"; flow:established,to_server; http.uri; content:"/count.php?id="; fast_pattern; content:"&c="; content:"&d="; http.user_agent; content:"Opera/9 (Windows"; startswith; reference:url,malwr.com/analysis/18c5b31198777f93a629a0357b22f2f8/; reference:md5,18c5b31198777f93a629a0357b22f2f8; reference:url,www.virustotal.com/file/94cf780fa829c16cd0b09a462b5419cd1175bac01ba935e906a109d97b4dadaa/; classtype:command-and-control; sid:2014777; rev:4; metadata:created_at 2012_05_18, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_05;)