alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan.Vaklik.kku Checkin Request"; flow:established,to_server; flowbits:set,et.trojan.valkik.kku; flowbits:noalert; http.uri; content:".rar"; fast_pattern; endswith; pcre:"/\x2f\d+?\x2erar$/"; reference:md5,9688d1d37a7ced200c53ec2b9332a0ad; reference:md5,81d8a235cb5f7345b5796483abe8145f; reference:md5,47a6dd02ee197f82b28cee0ab2b9bd35; classtype:command-and-control; sid:2012960; rev:11; metadata:created_at 2011_06_09, signature_severity Major, updated_at 2024_04_09;)