ET MALWARE VBS/TrojanDownloader.Agent.XAO Payload Inbound

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"ET MALWARE VBS/TrojanDownloader.Agent.XAO Payload Inbound";
    flow:established,to_client;
    http.content_type;
    content:"application/hta";
    http.response_body;
    content:"|3c|html|20|xmlns|3d 22|http|3a 2f 2f|www|2e|w3|2e|org|2f|1999|2f|xhtml|22 3e 0a 3c|head|3e 0a 3c|meta|20|content|3d 22|text|2f|html|3b 20|charset|3d|utf|2d|8|22 20|http|2d|equiv|3d 22|Content|2d|Type|22 20 2f 3e 0a 3c|script|20|language|3d 22|VBScript|22 3e 0a|Function|20|"; startswith; fast_pattern;
    pcre:"/(?:[a-zA-Z]{10,20})\x28\x29/R";
    content:"|0a|Dim|20|";
    reference:md5,0627702978f544eed9dd2cb0e876bba7;
    reference:md5,3253c1ecf5312f6d863176f195d47d38;
    classtype:trojan-activity;
    sid:2044909; rev:2;
    metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2023_04_07, deployment Perimeter, malware_family VBS_TrojanDownloader_Agent_XAO, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2023_04_19;
)