alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Hangover related campaign Response"; flow:established,to_client; http.stat_code; content:"200"; http.header_names; content:!"Referer|0d 0a|"; file.data; content:"|3a 5c|Bootfile|5c|firewall|5c|1"; pcre:"/^[C-J]\r\n/R"; reference:md5,f761060ced467394a6f87fd2204c6a74; reference:url,bluecoat.com/security-blog/2014-06-10/snake-grass-python-based-malware-used-targeted-attacks; classtype:trojan-activity; sid:2018567; rev:5; metadata:created_at 2014_06_17, signature_severity Major, updated_at 2020_05_21;)