alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET USER_AGENTS Suspicious User-Agent (DownloadMR)"; flow:to_server,established; http.user_agent; content:"DownloadMR"; nocase; depth:10; reference:url,www.virustotal.com/en/file/93236b781e147e3ac983be1374a5f807fabd27ee2b92e6d99e293a6eb070ac2b/analysis/; reference:md5,0da0d8e664f44400c19898b4c9e71456; classtype:trojan-activity; sid:2016903; rev:6; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2013_05_21, deployment Perimeter, confidence High, signature_severity Major, tag User_Agent, updated_at 2020_04_29;)