ET MALWARE Win32/Neurevt.A/Betabot Check-in 4

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE Win32/Neurevt.A/Betabot Check-in 4";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:!".aspx";
    http.user_agent;
    content:!"SmadavStat";
    http.host;
    content:!"lavasoft.com";
    http.request_body;
    content:!"Zerto.ZVM";
    content:!"id1=";
    content:"1=";
    content:"2="; distance:0;
    content:"3="; distance:0;
    content:"4="; distance:0; fast_pattern;
    pcre:"/&(?P<vname>[a-z]+)1=[A-F0-9]+&(?P=vname)2=[A-F0-9]+&(?P=vname)3=[A-F0-9]+&(?P=vname)4=[A-F0-9]/";
    http.content_type;
    content:"application/x-www-form-urlencoded";
    http.header_names;
    content:"|0d 0a|Content-Type|0d 0a|"; depth:16;
    content:!"Referer";
    content:!"Accept";
    reference:md5,5eada3ed47d7557df375d8798d2e0a8b;
    classtype:trojan-activity;
    sid:2018784; rev:13;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2014_07_25, deployment Perimeter, malware_family Neurevt, performance_impact Moderate, signature_severity Major, updated_at 2024_04_08, reviewed_at 2024_03_08;
)