alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Zberp receiving config via image file - SET"; flow:to_server,established; flowbits:set,ET.Zberp; flowbits:noalert; http.uri; content:".jpg"; endswith; http.request_line; content:".jpg HTTP/1."; fast_pattern; http.header_names; content:!"Referer"; reference:md5,1e1f44f8a403c4ebc6943eb2dcf731ff; reference:url,securityintelligence.com/new-zberp-trojan-discovered-zeus-zbot-carberp/#.U5Xgpyh4l8u; reference:url,blog.malwarebytes.org/security-threat/2014/02/hiding-in-plain-sight-a-story-about-a-sneaky-banking-trojan/; classtype:trojan-activity; sid:2021381; rev:11; metadata:created_at 2015_07_06, performance_impact Significant, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_04_08;)