ET MALWARE Simda.C Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Simda.C Checkin";
    flow:established,to_server;
    http.uri;
    content:"/?"; nocase;
    http.uri.raw;
    content:"=%96%";
    http.user_agent;
    content:"Mozilla/4.0 (compatible|3b 20|MSIE 8.0|3b 20|Trident/4.0|3b 20|.NET CLR 2.0.50727|3b 20|.NET CLR 1.1.4322|3b 20|.NET CLR 3.0.04506.590|3b 20|.NET CLR 3.0.04506.648|3b 20|.NET CLR 3.5.21022|3b 20|.NET CLR 3.0.4506.2152|3b 20|.NET CLR 3.5.30729)"; fast_pattern;
    http.header_names;
    content:"|0d 0a|Host|0d 0a|User-Agent|0d 0a 0d 0a|"; depth:22; endswith;
    reference:md5,10642e1067aca9f04ca874c02aabda5c;
    classtype:command-and-control;
    sid:2016300; rev:7;
    metadata:created_at 2012_07_20, signature_severity Major, updated_at 2020_09_15;
)