alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3891037)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/launches/09hwl43nz6q2tue/3933eca3d2883f0995aab36f0c53f87aebfc595f.exe"; depth:70; endswith; nocase; http.host; content:"cloudstorage-hub.com"; depth:20; isdataat:!1,relative; metadata:created_at 2026_07_24; reference:url, urlhaus.abuse.ch/url/3891037/; classtype:trojan-activity; sid:84754137; rev:1;)