alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE PWS.Win32/Daceluw.A Checkin"; flow:established,to_server; urilen:12; http.method; content:"POST"; http.uri; content:"/wow/wow.asp"; depth:12; http.header_names; content:!"User-Agent|0d 0a|"; content:!"Referer|0d 0a|"; http.request_body; content:"&WOWID="; depth:7; content:"&Area="; distance:0; content:"&WU="; distance:0; content:"&WP="; distance:0; content:"&MAX="; distance:0; content:"&Gold="; distance:0; content:"&Serv="; distance:0; content:"&rn="; distance:0; content:"&key="; distance:0; reference:url,xylibox.com/2014/01/trojwowspy-a.html; classtype:command-and-control; sid:2017970; rev:4; metadata:created_at 2014_01_14, signature_severity Major, updated_at 2020_04_27;)