alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"ET MALWARE Generic -POST To gate.php w/Extended ASCII Characters (Likely Zeus Derivative)";
flow:established,to_server;
http.method;
content:"POST";
http.uri;
content:"/gate.php";
http.request_body;
pcre:"/^.{0,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}[\x80-\xff]{1,3}[\x00-\x7f]{1,3}/";
http.header_names;
content:!"Referer";
classtype:bad-unknown;
sid:2016173; rev:10;
metadata:created_at 2013_01_08, confidence Medium, signature_severity Major, updated_at 2020_08_17;
)