alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Banker.bqba Checkin"; flow:to_server,established; http.uri; content:".php"; nocase; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MyApp)"; fast_pattern; bsize:31; http.request_body; content:"windows="; depth:8; content:"&av="; reference:md5,838d43239ba2c28bd968f8a7da64d340; classtype:command-and-control; sid:2023693; rev:3; metadata:created_at 2015_08_26, signature_severity Major, updated_at 2020_06_01;)