alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Possible ReactorBot .bin Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/cgi/"; content:".bin"; fast_pattern; endswith; pcre:"/\/cgi\/[a-z0-9]{1,31}\.bin$/"; http.header; content:!"AskTbARS"; http.host; content:!".passport.net"; endswith; content:!".microsoftonline-p.net"; endswith; content:!".symantec.com"; endswith; content:!".qq.com"; endswith; content:!"kankan.com"; endswith; content:!"aocdn.net"; http.header_names; content:!"Referer|0d 0a|"; content:!"Accept-Language|0d 0a|"; classtype:trojan-activity; sid:2022841; rev:5; metadata:created_at 2016_05_27, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_10_30;)