alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE VBKlip/ClipBanker.P Status Update"; flow:established,to_server; urilen:1; http.method; content:"POST"; http.uri; content:"/"; http.user_agent; bsize:66; content:"Mozilla/5.0 (compatible MSIE 9.0 Windows NT 6.1 WOW64 Trident/5.0)"; http.request_body; content:"tekst="; startswith; fast_pattern; pcre:"/^tekst=\w+$/i"; http.header_names; to_lowercase; content:!"|0d 0a|accept-"; reference:md5,ef230777f5b34291ea22bfc3c591ce2d; classtype:trojan-activity; sid:2022192; rev:6; metadata:created_at 2015_11_30, signature_severity Major, updated_at 2024_05_04;)