alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3866927)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/1ugscx3c83agbgdnortfner-hv852ff5ngxai68s75cywwz9dhqgvpq8kupi3ygydoa9v-0u4qag_7e3qhw_uqwlho15lobd00ffeqzpzmv9o3x7n6fj1b08znopqrx0fkwmxedxxpbndl05drbcbkqzsjusdftglunfodhmi9qc/pxcq0m6o5gcbwh9/%d0%92%d0%be%d0%best%d0%b0%d1%80%d1%80%d0%b5%d0%b3_%5b8.1.3%5d_%5bupd%5d_%d1%8564.zip"; depth:275; endswith; nocase; http.host; content:"download2349.mediafire.com"; depth:26; isdataat:!1,relative; metadata:created_at 2026_06_18; reference:url, urlhaus.abuse.ch/url/3866927/; classtype:trojan-activity; sid:84730027; rev:1;)