alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan-Ransom.Win32.Blocker.dham Checkin"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/?ID="; content:"&Serial="; content:"&acao="; content:"&Log="; content:"&PCInfo="; fast_pattern; reference:md5,e15b38251aed80298ba07169eb6ee2fa; classtype:command-and-control; sid:2022091; rev:4; metadata:created_at 2015_11_13, signature_severity Major, updated_at 2020_10_05;)