ET MALWARE Generic Stealer Config from Server

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE Generic Stealer Config from Server";
    flow:established,to_client;
    http.stat_code;
    content:"200";
    file.data;
    content:"wallets|3b 2a 3b 2d|";
    content:"|3b|Local|20|Extension|20|Settings"; distance:0;
    content:"azne|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0; fast_pattern;
    content:"pm|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0;
    content:"cc|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0;
    content:"rc|2e|exe|7c 25|TEMP|25 5c 7c|exe"; distance:0;
    reference:md5,0a7b32e75a01764ef5389a1d9e72ed63;
    classtype:trojan-activity;
    sid:2036883; rev:1;
    metadata:created_at 2022_06_06, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_06_06;
)