ET MALWARE Gamut Spambot Checkin 2

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Gamut Spambot Checkin 2";
    flow:established,to_server;
    urilen:6;
    http.method;
    content:"POST";
    http.uri;
    content:"/?8080"; fast_pattern;
    http.request_body;
    content:"name=|22|action|22 0d 0a 0d 0a|";
    pcre:"/^(?:Get(?:Subscription(?:EmailsBlock|Content)|PTR|IP)|Port25(?:Close|Open))\x0d\x0a/R";
    content:"name=|22|location|22 0d 0a 0d 0a|"; distance:0;
    pcre:"/^(?:winload(?:32)?|cmms)\x0d\x0a/R";
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/gamut-spambot-analysis;
    reference:md5,f00f3f47062646f900aa327b1d5ca3a1;
    classtype:command-and-control;
    sid:2018257; rev:6;
    metadata:created_at 2014_03_12, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_05_01;
)