alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Smardf/Boaxxe GET to cc.php3"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cc.php3"; fast_pattern; http.header_names; content:!"|0d 0a|Accept"; reference:md5,f856b4c526c3e5cee9d47df59295d2e1; reference:md5,232b4dbed0453e2a952630fb1076248f; classtype:trojan-activity; sid:2015617; rev:3; metadata:created_at 2012_08_11, signature_severity Major, updated_at 2024_02_19;)