alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Stoberox.B"; flow:established,to_server; http.method; content:"POST"; http.uri; content:".php"; http.connection; bsize:5; content:"Close"; http.accept_enc; bsize:4; content:"none"; fast_pattern; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; content:"|0d 0a|Host|0d 0a|"; startswith; http.request_body; pcre:"/^[a-zA-Z0-9\+\/]+={0,2}$/"; reference:md5,6ca1690720b3726bc76ef0e7310c9ee7; classtype:trojan-activity; sid:2018300; rev:5; metadata:created_at 2014_03_20, malware_family Win32_Stoberox_B, signature_severity Major, updated_at 2024_03_05;)