ET MALWARE MZRevenge Ransomware CnC

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET MALWARE MZRevenge Ransomware CnC";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:".php"; endswith;
    http.user_agent;
    content:"Mozilla/3.0 (compatible|3b 20|Indy Library)"; bsize:38;
    http.request_body;
    content:"filename|3d 22|TVpS"; fast_pattern;
    http.content_type;
    content:"multipart/form-data|3b 20|boundary=--------"; startswith;
    http.header_names;
    content:!"Referer|0d 0a|";
    reference:url,app.any.run/tasks/e5a3d700-993f-47ab-bde1-e9ed8e9d323e/;
    classtype:trojan-activity;
    sid:2029647; rev:3;
    metadata:attack_target Client_Endpoint, created_at 2020_03_18, deployment Perimeter, confidence High, signature_severity Major, tag Ransomware, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_11_09, mitre_tactic_id TA0040, mitre_tactic_name Impact, mitre_technique_id T1486, mitre_technique_name Data_Encrypted_for_Impact;
)