alert http1 $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE EUPUDS.A Requests for Boleto replacement"; flow:established,to_server; urilen:10; http.request_line; content:"POST /index.php HTTP/1."; fast_pattern; http.host; content:!"antia-client-log.puzzleplusgames.net"; http.header_names; content:"|0d 0a|Content-Type|0d 0a|"; content:"|0d 0a|Content-Length|0d 0a|"; content:!"|0d 0a|Referer|0d 0a|"; content:!"|0d 0a|User-Agent|0d 0a|"; content:!"|0d 0a|Accept"; content:!"|0d 0a|Connection|0d 0a|"; http.request_body; pcre:"/^[a-f0-9]{8}\x3d(?:[A-Za-z0-9-_]{4})*(?:[A-Za-z0-9-_]{2}==|[A-Za-z0-9-_]{3}=|[A-Za-z0-9-_]{4})$/i"; reference:url,blogs.rsa.com/wp-content/uploads/2015/07/Bolware-Fraud-Ring-RSA-Research-July-2-FINALr2.pdf; classtype:trojan-activity; sid:2018793; rev:10; metadata:created_at 2014_07_28, deprecation_reason Age, signature_severity Major, updated_at 2024_04_07, reviewed_at 2024_03_15;)