alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Trojan Downloader User-Agent (NOPE)"; flow:established,to_server; http.user_agent; content:"N0PE"; startswith; reference:url,support.clean-mx.de/clean-mx/view_joebox.php?md5=b0b7c391d084974b2666c1c57b349b62&id=711369; reference:url,www.virustotal.com/file-scan/report.html?id=54dcad20b326a409c09f1b059925ba4ba260ef58297cda1421ffca79942a96a5-1305296734; classtype:trojan-activity; sid:2013702; rev:7; metadata:affected_product Any, attack_target Client_Endpoint, created_at 2011_09_28, deployment Perimeter, confidence High, signature_severity Major, tag Trojan_Downloader, updated_at 2024_04_13;)