alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Mesquito Loader Related Activity (GET)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/CS/index.php?VS="; startswith; content:"&PL=NAO"; endswith; http.header.raw; content:"User-Agent|3a 20 22|Mozilla/5.0|20 20|AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.108 Safari/537.36|22|"; fast_pattern; http.header_names; content:!"|0d 0a|Referer|0d 0a|"; reference:md5,6d3d9667fce811c895b005dbce80cf24; reference:md5,3bef4091fcc587225cce05cd3b818459; reference:md5,5c5c0c34b86084c5ab799d28634f7503; reference:url,www.metabaseq.com/mosquito-the-new-infostealer-arrives-to-mexico/; classtype:trojan-activity; sid:2055906; rev:1; metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2024_09_17, deployment Perimeter, malware_family Win32_Mesquito, confidence High, signature_severity Major, tag Win32_Mesquito, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_09_17;)