ET MALWARE PWS.Win32/Daceluw.A Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE PWS.Win32/Daceluw.A Checkin";
    flow:established,to_server;
    urilen:12;
    http.method;
    content:"POST";
    http.uri;
    content:"/wow/wow.asp"; depth:12;
    http.header_names;
    content:!"User-Agent|0d 0a|";
    content:!"Referer|0d 0a|";
    http.request_body;
    content:"&WOWID="; depth:7;
    content:"&Area="; distance:0;
    content:"&WU="; distance:0;
    content:"&WP="; distance:0;
    content:"&MAX="; distance:0;
    content:"&Gold="; distance:0;
    content:"&Serv="; distance:0;
    content:"&rn="; distance:0;
    content:"&key="; distance:0;
    reference:url,xylibox.com/2014/01/trojwowspy-a.html;
    classtype:command-and-control;
    sid:2017970; rev:4;
    metadata:created_at 2014_01_14, signature_severity Major, updated_at 2020_04_27;
)