alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3896333)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/cl/a5uyfw_dao7l4uk02y5e3t4rkwwlaq7x5fxatyv8o3ujaut_k5ia0vibwvrxblxmngzek9whhahsqfobqqcupkzzinkihgmggocp1yiigbo6jupzwhm0ybf._jurp0lhkb4wt0m5h1gyc3ag149v2da397unky11uvn30sf8dgjjmiztmjs_ugzti_jqupelruzgnwj2gvsmsoq9_0idavjwlmubiwllphaogxqn4ckh--rczgx49rzqev4ixm--n6cy14rgi..inc2atg5k9g~~"; depth:284; endswith; nocase; http.host; content:"mt-link.qdhuzf.cc"; depth:17; isdataat:!1,relative; metadata:created_at 2026_08_03; reference:url, urlhaus.abuse.ch/url/3896333/; classtype:trojan-activity; sid:84759433; rev:1;)