ET RETIRED Win32/Agent.XXZ Checkin

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"ET RETIRED Win32/Agent.XXZ Checkin";
    flow:established,to_server;
    http.method;
    content:"GET";
    http.uri;
    content:".php?type=";
    content:"compName=";
    content:"visiteNow=";
    content:"code=";
    content:"ip=";
    content:"sys=";
    content:"ver=";
    content:"setuptime=";
    content:"qq=";
    content:"md5=";
    http.user_agent;
    content:"type=";
    content:"compName=";
    content:"visiteNow="; fast_pattern;
    content:"code=";
    content:"ip=";
    content:"sys=";
    content:"ver=";
    content:"setuptime=";
    content:"qq=";
    content:"md5=";
    http.header_names;
    content:!"Referer";
    reference:md5,c5b851f8889a18d9e80df3dbdbeb1ac0;
    classtype:trojan-activity;
    sid:2038900; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2022_09_19, deployment Perimeter, former_category MALWARE, malware_family Win32_Agent_XXZ, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_04_17, reviewed_at 2025_04_17;
)