alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE RAMNIT.A M2"; flow:established,from_server; file_data; content:"|6c 61 6e 67 75 61 67 65 3d 56 42 53 63 72 69 70 74|"; nocase; content:"|57 72 69 74 65 44 61 74 61 20 3d|"; nocase; content:"|22 34 44 35 41 39 30 30|"; nocase; distance:0; content:"|44 72 6f 70 46 69 6c 65 4e 61 6d 65 20 3d 20|"; reference:url,www.microsoft.com/security/portal/threat/Encyclopedia/Entry.aspx?Name=Virus%3AWin32%2FRamnit.A; classtype:trojan-activity; sid:2023029; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2016_08_09, deployment Perimeter, malware_family Ramnit, performance_impact Low, confidence High, signature_severity Major, updated_at 2019_07_26;)