alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3893517)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/21oatf109angbyhs_5e13zp2tv1nrhfnvj0gg1xu8cninympqsqqwvibdhtgzbv502qkprty_f7v0q1ydiezapki058yotyuvqlppv9imhcjinamwk9tx8k4_hybidy1vxzluyzsvrait9t28ci2sqpym_8wape4cldt3kohikpzbng/efqgjl6i8zrh9vw/x86"; depth:196; endswith; nocase; http.host; content:"download1532.mediafire.com"; depth:26; isdataat:!1,relative; metadata:created_at 2026_07_29; reference:url, urlhaus.abuse.ch/url/3893517/; classtype:trojan-activity; sid:84756617; rev:1;)