alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Gozi/Ursnif/Papras Connectivity Check"; flow:established,to_server; urilen:13; http.method; content:"GET"; http.uri; content:"/usdeclar.txt"; fast_pattern; http.header_names; content:!"Accept"; content:!"Referer|0d 0a|"; reference:md5,5f3530edbe1fce44e05ad0c96e54efb4; reference:md5,279fc5e6181d58f883a15d5089ce541b; reference:url,krebsonsecurity.com/2013/01/three-men-charged-in-connection-with-gozi-trojan/; reference:url,csis.dk/en/csis/news/4472/; classtype:trojan-activity; sid:2019380; rev:6; metadata:created_at 2014_10_09, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_09_25;)