alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fivfrom Downloader (Unitrix)"; flow:established,to_server; http.uri; content:".php?seller="; fast_pattern; content:"&hash={"; pcre:"/hash=\{[a-f0-9]+-/i"; classtype:trojan-activity; sid:2013555; rev:6; metadata:created_at 2011_09_10, signature_severity Major, updated_at 2024_03_16;)