ET MALWARE Hiloti/Mufanom Downloader Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Hiloti/Mufanom Downloader Checkin";
    flow:established,to_server;
    flowbits:set,ET.Hiloti;
    http.uri;
    content:"/get"; nocase;
    content:".php?c="; nocase; distance:0;
    content:"&d="; nocase; distance:0;
    pcre:"/\/get\d*\.php\?c=[A-Z]{8}&d=[0-9A-F]{250,}$/";
    reference:url,www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Trojan%3aWin32%2fHiloti.gen!A;
    reference:url,blog.fortinet.com/hiloti-the-botmaster-of-disguise/;
    classtype:command-and-control;
    sid:2010071; rev:11;
    metadata:created_at 2010_07_30, signature_severity Major, updated_at 2020_04_27;
)