alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Kryptik.BSYO Checkin 2"; flow:to_server,established; http.uri; content:"/cmd?version="; fast_pattern; content:"&aid="; content:"&id="; content:"&os="; pcre:"/&id=[a-f0-9]{8}(-[a-f0-9]{4}){4}[a-f0-9]{8}&os=/"; reference:md5,494d0fb7efaabaf9c69edbc58360671f; reference:md5,1fd3e714669ac8a3bc4af33a3e6cf21f; reference:url,www.virusradar.com/en/Win32_Kryptik.BSYO/description; classtype:command-and-control; sid:2018198; rev:6; metadata:created_at 2014_01_22, malware_family Win32_Kryptik_BSYO, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_22;)