alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE JS/Spy.Agent.AW Download"; flow:established,to_client; http.response_body; content:"var"; startswith; content:"|5c 78 37 30 5c 78 36 31 5c 78 37 39 5c 78 36 44 5c 78 36 35 5c 78 36 45 5c 78 37 34 5c 78 35 46 5c 78 36 36 5c 78 36 46 5c 78 37 32 5c 78 36 44 5c 78 35 46 5c 78 36 33 5c 78 36 33 5c 78 37 33 5c 78 36 31 5c 78 37 36 5c 78 36 35|"; within:90; fast_pattern; content:"|5c 78 36 35 5c 78 37 30 5c 78 36 31 5c 78 37 39 5c 78 35 46 5c 78 37 33 5c 78 36 35 5c 78 36 33 5c 78 37 35 5c 78 37 32 5c 78 36 35 5c 78 35 46 5c 78 37 30 5c 78 36 31 5c 78 37 39 5c 78 36 44 5c 78 36 35 5c 78 36 45 5c 78 37 34|"; distance:62; within:76; reference:md5,ade43b2b2cf95ca908b82fe0e76ea54d; classtype:trojan-activity; sid:2034020; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_09_23, deployment Perimeter, malware_family JS_Spy_Agent_AW, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_03_09;)