alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3882338)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/dl/file/8140e835-c8d0-466f-aaa4-7b544072129a|3f|t=5f7820a6-8229-4c38-9e27-88c58cc76ec3"; depth:87; endswith; nocase; http.host; content:"xverikstat.us"; depth:13; isdataat:!1,relative; metadata:created_at 2026_07_07; reference:url, urlhaus.abuse.ch/url/3882338/; classtype:trojan-activity; sid:84745438; rev:1;)