alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE PurpleFox Backdoor/Rootkit Download Server Response M4"; flow:established,to_client; http.stat_code; content:"200"; http.content_type; content:"application/octet-stream"; bsize:24; http.server; content:"HFS|20|"; startswith; fast_pattern; http.cookie; content:"HFS_SID_="; startswith; http.header; content:"|0d 0a|Content|2d|Disposition|3a 20|attachment|3b 20|filename|2a 3d|UTF|2d|8|27 27|"; content:"|3b 20|filename="; distance:1; within:11; content:"|0d 0a|"; distance:1; within:2; endswith; http.response_body; content:"Rar|21 1A 07|"; startswith; content:"|2e|lnk"; within:150; reference:md5,930d405c7653dcf36c04e75224a2ff9d; reference:url,www.trendmicro.com/en_us/research/22/c/purple-fox-uses-new-arrival-vector-and-improves-malware-arsenal.html; classtype:command-and-control; sid:2035622; rev:1; metadata:created_at 2022_03_28, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_03_28;)