alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE BalkanDoor CnC Checkin - Server Response"; flow:established,to_client; http.stat_code; content:"200"; file.data; content:"[CFG]|0d 0a|di="; fast_pattern; depth:10; content:"|0d 0a|cn="; content:"|0d 0a|du="; content:"|0d 0a|int="; content:"|0d 0a|rip="; content:"|0d 0a|rpo="; content:"|0d 0a|scr_dur="; content:"|0d 0a|scr_int="; reference:url,www.welivesecurity.com/2019/08/14/balkans-businesses-double-barreled-weapon/; reference:md5,f70ef75fb0a51b05c43aaec973ac0bc1; classtype:command-and-control; sid:2027898; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_08_20, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_09_01;)