alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Fareit/Pony Downloader Checkin 3"; flow:established,to_server; flowbits:set,ET.Fareit.chk; http.method; content:"GET"; http.user_agent; content:"Mozilla/4.0 (compatible|3b 20|MSIE 5.0"; startswith; content:"Windows 98)"; fast_pattern; endswith; http.accept; content:"*/*"; http.connection; content:"close"; http.header_names; content:"|0d 0a|Host|0d 0a|"; startswith; content:"|0d 0a|Connection|0d 0a|User-Agent|0d 0a|"; reference:md5,dcc2c110e509fa777ab1460f665bd137; reference:md5,bf422f3aa215d896f55bbe2ebcd25d17; reference:md5,d50c39753ba88daa00bc40848f174168; reference:md5,9544c681ae5c4fe3fdbd4d5c6c90e38e; classtype:command-and-control; sid:2014234; rev:17; metadata:created_at 2012_02_17, deprecation_reason Age, signature_severity Major, updated_at 2024_04_14, reviewed_at 2024_03_18;)