alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3896331)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/cl/1ti4_qy7dcebkeln5kmk9jrsozkvcgnqofof.bp_ka4knqy51he4r8irtwhlz2i_o_2nu1kmvvszh_zv7baowqdlryyzqpe8r_qsdciqel3f70u7skywz.3b98zvfhcxcdzmsyed7ruj5.hif56qvuda9tu0yyihnps9u9frmfrupufu4wnzg58wpv.jzgunkfksrvpkboquhgjkbiytgq_rfpm.1ldbjbc~--nucyngcfq.n1c.5q--k8navtprtztzg9ygwu3p8g~~"; depth:276; endswith; nocase; http.host; content:"mt-link.hxnxajp.club"; depth:20; isdataat:!1,relative; metadata:created_at 2026_08_03; reference:url, urlhaus.abuse.ch/url/3896331/; classtype:trojan-activity; sid:84759431; rev:1;)