ET MALWARE Shamoon v3 64bit Propagating Internally via SMB

alert smb $HOME_NET any -> $HOME_NET any (
    msg:"ET MALWARE Shamoon v3 64bit Propagating Internally via SMB";
    flow:to_server,established;
    content:"|00 00 00 00 00 00|";
    content:"MZ"; distance:2; within:2;
    byte_jump:4,58,relative,little;
    content:"PE|00 00|"; distance:-64; within:4;
    content:"|48 FF C5 42 0F B6|"; distance:0; fast_pattern;
    content:"|32 45|"; distance:2; within:2;
    content:"|41 88 41 FF|"; distance:1; within:4;
    reference:url,www.trendmicro.com/vinfo/hk-en/security/news/cybercrime-and-digital-threats/new-version-of-disk-wiping-shamoon-disttrack-spotted-what-you-need-to-know;
    classtype:trojan-activity;
    sid:2026733; rev:1;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target SMB_Server, created_at 2018_12_14, deployment Perimeter, malware_family Shamoon, performance_impact Low, confidence Medium, signature_severity Major, tag SMB, tag Worm, tag Wiper, updated_at 2019_07_26;
)