alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE Win32.Banker.bqba Checkin"; flow:established,to_server; http.uri; content:".php"; nocase; http.user_agent; bsize:31; content:"Mozilla/4.0 (compatible|3b 20|MyApp)"; fast_pattern; http.request_body; content:"windows="; startswith; content:"&av="; reference:md5,838d43239ba2c28bd968f8a7da64d340; classtype:command-and-control; sid:2023693; rev:6; metadata:created_at 2015_08_26, signature_severity Major, updated_at 2024_04_14;)