alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Almanahe.B Checkin"; flow:to_server,established; urilen:1; http.method; content:"GET"; http.user_agent; content:"ClientUpdate"; fast_pattern; http.header_names; content:!"Accept|0d 0a|"; content:!"Referer|0d 0a|"; reference:url,www.virustotal.com/en/file/f80fc95e44d90a8e02de4fde0ea5e58227cbbde7b6d3848c1f8afbd5ed0affe7/analysis/; reference:md5,1d331ef7d24f6316947e94f737d1f219; classtype:command-and-control; sid:2018123; rev:6; metadata:created_at 2014_02_12, malware_family Win32_Almanahe_B, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_28;)