alert tcp $EXTERNAL_NET 9000:10000 -> $HOME_NET any (msg:"ET MALWARE Win32/Recslurp.D C2 Response"; flow:established,from_server; flowbits:isset,ET.Reslurp.D.Client; content:"|e8 03 00 00|"; depth:4; reference:md5,fcf364abd9c82d89f8d0b4b091276b41; classtype:command-and-control; sid:2020155; rev:2; metadata:created_at 2015_01_08, malware_family Win32_Recslurp_D, signature_severity Major, updated_at 2019_07_26;)