alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET RETIRED Win32/SSLoad Payload Response"; flow:established,to_client; flowbits:isset,ET.SSLoad1_1.PayloadRetrieval; http.stat_code; content:"200"; http.header; content:"Content-Disposition|3a 20|attachment|3b 20|filename="; content:"crypted_dll.bin"; fast_pattern; within:15; file.data; content:"7zXZ"; depth:5; reference:md5,ca303668b5420c022ef9c78ce1f2bfb7; classtype:trojan-activity; sid:2052121; rev:2; metadata:created_at 2024_04_16, former_category MALWARE, malware_family Win32_SSLoad, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_07_14, reviewed_at 2025_07_14; target:dest_ip;)