alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Fake Google Chrome Notifications Installer"; flow:established,to_client; http.response_body; content:"|28|function|20 28 29|"; startswith; content:"callbackName|3a 20 27|onSubInit|27|"; distance:0; content:"workerName|3a 20 27|"; distance:0; content:"serverUrl|3a 20 27|"; distance:0; content:"applicationServerKey|3a 20|"; distance:0; content:"cookieNameS|3a 20 27|notify|2d|p|27|"; fast_pattern; distance:0; reference:url,rapid7.com/blog/post/2021/10/28/sneaking-through-windows-infostealer-malware-masquerades-as-windows-application; reference:md5,45602bfa86ee9a5e31758a24a0d5cd08; classtype:trojan-activity; sid:2034307; rev:3; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2021_10_29, deployment Perimeter, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_04_10;)