alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32/Zemot Config Download"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/soft"; content:".dll"; fast_pattern; pcre:"/\/soft(?:32|64)\.dll$/i"; http.header; content:"Accept|3a 20|*/*|0d 0a|Connection|3a 20|Close|0d 0a|"; startswith; content:"User-Agent|3a|"; http.header_names; content:!"Referer"; reference:md5,5a99a6a6cd8600ea88a8fcc1409b82f4; classtype:trojan-activity; sid:2018661; rev:7; metadata:created_at 2014_07_10, malware_family Win32_Zemot, performance_impact Significant, signature_severity Major, updated_at 2024_04_14;)