alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Prinimalka Configuration Update Request"; flow:established,to_server; http.uri; content:"/options?user_id="; fast_pattern; content:"&version_id="; content:"&crc="; content:"&uptime="; content:"&port="; content:"&ip="; reference:url,ddos.arbornetworks.com/2012/10/trojan-prinimalka-bits-and-pieces/; classtype:trojan-activity; sid:2016048; rev:3; metadata:created_at 2012_12_18, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_17;)