alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBKlip/ClipBanker.P Status Update"; flow:established,to_server; urilen:1; http.method; content:"POST"; http.uri; content:"/"; http.user_agent; content:"Mozilla/5.0 (compatible MSIE 9.0 Windows NT 6.1 WOW64 Trident/5.0)"; bsize:66; http.request_body; content:"tekst="; depth:6; fast_pattern; pcre:"/^tekst=\w+$/i"; http.header_names; content:!"Accept-"; reference:md5,ef230777f5b34291ea22bfc3c591ce2d; classtype:trojan-activity; sid:2022192; rev:3; metadata:created_at 2015_11_30, signature_severity Major, updated_at 2020_06_09;)