alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Simda.C Checkin"; flow:established,to_server; http.uri; content:"/?"; nocase; http.uri.raw; content:"=%96%"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 8.0|3b 20|Trident/4.0|3b 20|.NET CLR 2.0.50727|3b 20|.NET CLR 1.1.4322|3b 20|.NET CLR 3.0.04506.590|3b 20|.NET CLR 3.0.04506.648|3b 20|.NET CLR 3.5.21022|3b 20|.NET CLR 3.0.4506.2152|3b 20|.NET CLR 3.5.30729)"; fast_pattern; http.header_names; content:"|0d 0a|Host|0d 0a|User-Agent|0d 0a 0d 0a|"; depth:22; endswith; reference:md5,10642e1067aca9f04ca874c02aabda5c; classtype:command-and-control; sid:2016300; rev:7; metadata:created_at 2012_07_20, signature_severity Major, updated_at 2020_09_15;)