alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Matsnu.L Checkin"; flow:to_server,established; http.method; content:"GET"; http.uri; content:".php?text="; content:"&img_url=http"; distance:0; content:"&rpt=simage&pos="; distance:0; fast_pattern; http.header_names; content:!"Accept|0d 0a|"; content:!"Referer|0d 0a|"; http.user_agent; content:" Windows NT 5.0"; nocase; reference:url,microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=TROJAN%3AWIN32/MATSNU.L; reference:md5,38b1862a42a6453d8ccdf1c2d2eff018; classtype:command-and-control; sid:2018200; rev:5; metadata:created_at 2014_03_04, deprecation_reason Age, malware_family Win32_Matsnu_L, signature_severity Major, updated_at 2024_02_15, reviewed_at 2024_02_15;)