alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Backdoor.Win32/Etumbot.B Requesting RC4 Key"; flow:to_server,established; http.uri; content:"/home/index.asp?typeid="; nocase; fast_pattern; pcre:"/^\/home\/index\.asp\?typeid=(?:1[13]?|[3579])$/i"; http.referer; content:"http|3a|//www.google.com/"; bsize:22; reference:md5,82d4850a02375a7447d2d0381b642a72; reference:md5,ff5a7a610746ab5492cc6ab284138852; reference:url,arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf; classtype:trojan-activity; sid:2018552; rev:5; metadata:created_at 2014_06_09, signature_severity Major, updated_at 2020_09_24;)