alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"URLhaus Known malware download URL detected (3896336)"; flow:established,from_client; http.method; content:"GET"; http.uri; content:"/cl/rllxixswv8iks9awzyqx.gteiy.dfpltrpy013hmjghjiqnpzyu0.3grfdjuvkq6te_brewyxijycce5tvenoe3kbutwvcdtiu2bdhwxzs0x1w9uo0ivh.1qngrtx1fchw7ragf7rgebqpkgahtmo9pnvobfpz6zwewwmf.a8wcbwexrfhkajhlsixt2nztt0u74bljpjjsehoma6bax63e8owmzhpihcbw2sq~~--2ijbf9qxryunjzju--8oh.0r5jkh3jzkgt7hz3yq~~"; depth:280; endswith; nocase; http.host; content:"mt-link.qdhuzf.cc"; depth:17; isdataat:!1,relative; metadata:created_at 2026_08_03; reference:url, urlhaus.abuse.ch/url/3896336/; classtype:trojan-activity; sid:84759436; rev:1;)