alert tcp $HOME_NET any -> $EXTERNAL_NET 10001 (msg:"ET MALWARE Win32.Bumrat.B Checkin"; flow:established,to_server; dsize:19; content:"|0f 00 00 00|"; depth:4; content:"mconfig_10"; reference:md5,647edeb30a04eeb30b7f8921645c7369; classtype:command-and-control; sid:2019941; rev:1; metadata:created_at 2014_12_16, signature_severity Major, updated_at 2019_07_26;)