alert http1 $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Trojan.Vaklik.kku Checkin Response"; flow:established,to_client; flowbits:isset,et.trojan.valkik.kku; flowbits:unset,et.trojan.valkik.kku; http.header; content:"Content-Length|3a 20|88|0d 0a|"; fast_pattern; nocase; file.data; content:"|48 00 00 00|"; offset:4; depth:4; reference:md5,9688d1d37a7ced200c53ec2b9332a0ad; reference:md5,81d8a235cb5f7345b5796483abe8145f; classtype:command-and-control; sid:2012961; rev:7; metadata:created_at 2011_06_09, signature_severity Major, updated_at 2024_05_06;)