alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE KINS/ZeusVM Variant Retrieving Config"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/config"; fast_pattern; content:".jpg"; endswith; pcre:"/\/config[^\x2e\x2f]*?\.jpg$/"; http.header; header_lowercase; content:"cache-control|3a 20|no-cache"; http.user_agent; pcre:"/(?:\x20MSIE\x20|rv\x3a11)/"; http.connection; content:"close"; nocase; http.header_names; to_lowercase; content:!"|0d 0a|accept-"; content:!"|0d 0a|referer|0d 0a|"; reference:md5,7a015848f24de23da43e2ca9970df11e; classtype:trojan-activity; sid:2021528; rev:10; metadata:created_at 2015_07_23, deprecation_reason Age, signature_severity Major, updated_at 2024_04_30, reviewed_at 2024_04_02;)