alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE LokiBot User-Agent (Charon/Inferno)"; flow:established,to_server; http.user_agent; content:"(Charon|3b 20|Inferno)"; fast_pattern; classtype:trojan-activity; sid:2021641; rev:10; metadata:created_at 2015_08_18, malware_family lokibot, confidence High, signature_severity Critical, updated_at 2024_11_20, reviewed_at 2024_04_10;)