alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Urlzone/Bebloh Communication with Controller"; flow:established,to_server; http.method; content:"GET"; nocase; http.uri; content:"?type=slg&id="; fast_pattern; nocase; pcre:"/\?type=slg&id=[0-9A-Z]{18}/"; reference:url,threatinfo.trendmicro.com/vinfo/grayware/ve_graywareDetails.asp?GNAME=TSPY_BEBLOH.KO&VSect=Td; classtype:trojan-activity; sid:2009351; rev:9; metadata:created_at 2010_07_30, malware_family URLZone, signature_severity Major, tag Banking_Trojan, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_16;)